# Flog Txt Version 1 # Analyzer Version: 3.0.2 # Analyzer Build Date: Jun 6 2019 12:21:16 # Log Creation Date: 03.07.2019 15:12:46.523 Process: id = "1" image_name = "1.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1.exe" page_root = "0x4d8c3000" os_pid = "0xa20" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xa24 [0029.100] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0031.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe.config", nBufferLength=0x105, lpBuffer=0x15e8c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe.config", lpFilePart=0x0) returned 0x32 [0031.454] GetCurrentProcess () returned 0xffffffff [0031.455] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x15ec6c | out: TokenHandle=0x15ec6c*=0x1d4) returned 1 [0031.459] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x15e74c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0031.815] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x15ec6c | out: lpFileInformation=0x15ec6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0cc4300, ftCreationTime.dwHighDateTime=0x1cd5cf4, ftLastAccessTime.dwLowDateTime=0xcf7ee640, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc0cc4300, ftLastWriteTime.dwHighDateTime=0x1cd5cf4, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0031.817] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x15e718, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0031.818] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x15ec6c | out: lpFileInformation=0x15ec6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0cc4300, ftCreationTime.dwHighDateTime=0x1cd5cf4, ftLastAccessTime.dwLowDateTime=0xcf7ee640, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc0cc4300, ftLastWriteTime.dwHighDateTime=0x1cd5cf4, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0031.819] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x15e6a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0031.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x15eb98) returned 1 [0031.820] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x1e4 [0031.821] GetFileType (hFile=0x1e4) returned 0x1 [0031.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x15eb94) returned 1 [0031.821] GetFileType (hFile=0x1e4) returned 0x1 [0031.830] GetFileSize (in: hFile=0x1e4, lpFileSizeHigh=0x15ec60 | out: lpFileSizeHigh=0x15ec60*=0x0) returned 0x8c8f [0031.830] ReadFile (in: hFile=0x1e4, lpBuffer=0x287d174, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x15ec1c, lpOverlapped=0x0 | out: lpBuffer=0x287d174*, lpNumberOfBytesRead=0x15ec1c*=0x1000, lpOverlapped=0x0) returned 1 [0031.845] ReadFile (in: hFile=0x1e4, lpBuffer=0x287d174, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x15eab8, lpOverlapped=0x0 | out: lpBuffer=0x287d174*, lpNumberOfBytesRead=0x15eab8*=0x1000, lpOverlapped=0x0) returned 1 [0031.846] ReadFile (in: hFile=0x1e4, lpBuffer=0x287d174, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x15e96c, lpOverlapped=0x0 | out: lpBuffer=0x287d174*, lpNumberOfBytesRead=0x15e96c*=0x1000, lpOverlapped=0x0) returned 1 [0031.846] ReadFile (in: hFile=0x1e4, lpBuffer=0x287d174, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x15e96c, lpOverlapped=0x0 | out: lpBuffer=0x287d174*, lpNumberOfBytesRead=0x15e96c*=0x1000, lpOverlapped=0x0) returned 1 [0031.846] ReadFile (in: hFile=0x1e4, lpBuffer=0x287d174, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x15e96c, lpOverlapped=0x0 | out: lpBuffer=0x287d174*, lpNumberOfBytesRead=0x15e96c*=0x1000, lpOverlapped=0x0) returned 1 [0031.847] ReadFile (in: hFile=0x1e4, lpBuffer=0x287d174, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x15e8a4, lpOverlapped=0x0 | out: lpBuffer=0x287d174*, lpNumberOfBytesRead=0x15e8a4*=0x1000, lpOverlapped=0x0) returned 1 [0031.854] ReadFile (in: hFile=0x1e4, lpBuffer=0x287d174, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x15ea20, lpOverlapped=0x0 | out: lpBuffer=0x287d174*, lpNumberOfBytesRead=0x15ea20*=0x1000, lpOverlapped=0x0) returned 1 [0031.855] ReadFile (in: hFile=0x1e4, lpBuffer=0x287d174, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x15e934, lpOverlapped=0x0 | out: lpBuffer=0x287d174*, lpNumberOfBytesRead=0x15e934*=0x1000, lpOverlapped=0x0) returned 1 [0031.855] ReadFile (in: hFile=0x1e4, lpBuffer=0x287d174, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x15e934, lpOverlapped=0x0 | out: lpBuffer=0x287d174*, lpNumberOfBytesRead=0x15e934*=0xc8f, lpOverlapped=0x0) returned 1 [0031.855] ReadFile (in: hFile=0x1e4, lpBuffer=0x287d174, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x15e9f4, lpOverlapped=0x0 | out: lpBuffer=0x287d174*, lpNumberOfBytesRead=0x15e9f4*=0x0, lpOverlapped=0x0) returned 1 [0031.856] CloseHandle (hObject=0x1e4) returned 1 [0031.857] GetCurrentProcess () returned 0xffffffff [0031.857] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x15eda0 | out: TokenHandle=0x15eda0*=0x1e4) returned 1 [0031.857] GetCurrentProcess () returned 0xffffffff [0031.857] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x15eda0 | out: TokenHandle=0x15eda0*=0x1e8) returned 1 [0031.858] GetCurrentProcess () returned 0xffffffff [0031.858] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x15ec6c | out: TokenHandle=0x15ec6c*=0x1ec) returned 1 [0031.858] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe.config" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x15ec6c | out: lpFileInformation=0x15ec6c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0031.858] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe.config", nBufferLength=0x105, lpBuffer=0x15e718, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe.config", lpFilePart=0x0) returned 0x32 [0031.858] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe.config" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x15ec6c | out: lpFileInformation=0x15ec6c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0031.859] GetCurrentProcess () returned 0xffffffff [0031.859] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x15eda0 | out: TokenHandle=0x15eda0*=0x1f0) returned 1 [0031.859] GetCurrentProcess () returned 0xffffffff [0031.859] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x15eda0 | out: TokenHandle=0x15eda0*=0x1f4) returned 1 [0031.874] GetCurrentProcess () returned 0xffffffff [0031.874] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x15eb68 | out: TokenHandle=0x15eb68*=0x1f8) returned 1 [0031.900] GetCurrentProcess () returned 0xffffffff [0031.900] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x15eb78 | out: TokenHandle=0x15eb78*=0x1fc) returned 1 [0031.955] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x15e1e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0031.955] GetModuleHandleW (lpModuleName="webengine4.dll") returned 0x0 [0031.956] LoadLibraryW (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\webengine4.dll") returned 0x74720000 [0032.522] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0032.522] CoUninitialize () [0032.561] EtwEventRegister () returned 0x0 [0032.570] GetCurrentProcess () returned 0xffffffff [0032.570] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x15e6fc | out: TokenHandle=0x15e6fc*=0x248) returned 1 [0032.571] GetCurrentProcess () returned 0xffffffff [0032.572] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x15e6d0 | out: TokenHandle=0x15e6d0*=0x264) returned 1 [0032.572] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x15e704 | out: TokenInformation=0x0, ReturnLength=0x15e704) returned 0 [0032.573] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x31e380 [0032.573] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0x31e380, TokenInformationLength=0x24, ReturnLength=0x15e704 | out: TokenInformation=0x31e380, ReturnLength=0x15e704) returned 1 [0032.574] LocalFree (hMem=0x31e380) returned 0x0 [0032.576] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x15e624, DesiredAccess=0x800, PolicyHandle=0x15e5e4 | out: PolicyHandle=0x15e5e4) returned 0x0 [0032.577] LsaLookupSids (in: PolicyHandle=0x319f20, Count=0x1, Sids=0x2899a00*=0x289996c*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), ReferencedDomains=0x15e600, Names=0x15e5f4 | out: ReferencedDomains=0x15e600, Names=0x15e5f4) returned 0x0 [0032.578] LsaClose (ObjectHandle=0x319f20) returned 0x0 [0032.579] LsaFreeMemory (Buffer=0x318960) returned 0x0 [0032.579] LsaFreeMemory (Buffer=0x318610) returned 0x0 [0032.623] FindResourceA (hModule=0x0, lpName=0x77, lpType=0x17) returned 0x13a82e8 [0032.630] SizeofResource (hModule=0x0, hResInfo=0x13a82e8) returned 0xad200 [0032.636] LoadResource (hModule=0x0, hResInfo=0x13a82e8) returned 0x13af7c8 [0032.641] LockResource (hResData=0x13af7c8) returned 0x13af7c8 Thread: id = 2 os_tid = 0xa28 Thread: id = 3 os_tid = 0xa2c [0029.101] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0033.259] CloseHandle (hObject=0x1f4) returned 1 [0033.260] CloseHandle (hObject=0x1f0) returned 1 [0033.260] CloseHandle (hObject=0x248) returned 1 [0033.260] CloseHandle (hObject=0x1ec) returned 1 [0033.260] CloseHandle (hObject=0x1e8) returned 1 [0033.260] CloseHandle (hObject=0x1fc) returned 1 [0033.260] CloseHandle (hObject=0x1e4) returned 1 [0033.260] CloseHandle (hObject=0x1f8) returned 1 [0033.260] CloseHandle (hObject=0x264) returned 1 [0033.260] CloseHandle (hObject=0x1d4) returned 1 [0041.470] CoGetContextToken (in: pToken=0xbbf890 | out: pToken=0xbbf890) returned 0x0 [0041.470] CoGetContextToken (in: pToken=0xbbf818 | out: pToken=0xbbf818) returned 0x0 [0041.470] WbemLocator:IUnknown:Release (This=0xad50a00) returned 0x1 [0041.470] WbemLocator:IUnknown:Release (This=0xad50a00) returned 0x0 [0041.470] CoGetContextToken (in: pToken=0xbbf818 | out: pToken=0xbbf818) returned 0x0 [0041.470] IUnknown:Release (This=0xad5d2e0) returned 0x2 [0041.470] IUnknown:Release (This=0xad5d2e0) returned 0x1 [0041.470] IUnknown:Release (This=0xad5d2e0) returned 0x0 [0041.471] CoGetContextToken (in: pToken=0xbbf6b0 | out: pToken=0xbbf6b0) returned 0x0 [0041.471] WbemLocator:IUnknown:Release (This=0x35ccd4) returned 0x1 [0041.471] IUnknown:Release (This=0xad5c934) returned 0x0 [0041.486] RegCloseKey (hKey=0x1e8) returned 0x0 [0041.486] RegCloseKey (hKey=0x1fc) returned 0x0 [0041.486] RegCloseKey (hKey=0x1e4) returned 0x0 [0041.486] RegCloseKey (hKey=0x1f8) returned 0x0 [0041.486] RegCloseKey (hKey=0x1d4) returned 0x0 [0041.487] RegCloseKey (hKey=0x264) returned 0x0 [0041.533] CoGetContextToken (in: pToken=0xbbf890 | out: pToken=0xbbf890) returned 0x0 [0041.533] CoGetContextToken (in: pToken=0xbbf818 | out: pToken=0xbbf818) returned 0x0 [0041.533] WbemDefPath:IUnknown:Release (This=0xad50820) returned 0x1 [0041.533] WbemDefPath:IUnknown:Release (This=0xad50820) returned 0x0 [0041.533] CoGetContextToken (in: pToken=0xbbf818 | out: pToken=0xbbf818) returned 0x0 [0041.533] WbemDefPath:IUnknown:Release (This=0xad63050) returned 0x1 [0041.533] WbemDefPath:IUnknown:Release (This=0xad63050) returned 0x0 [0041.534] CoGetContextToken (in: pToken=0xbbf890 | out: pToken=0xbbf890) returned 0x0 [0041.534] CoGetContextToken (in: pToken=0xbbf818 | out: pToken=0xbbf818) returned 0x0 [0041.534] WbemLocator:IUnknown:Release (This=0x35ab8c) returned 0x1 [0041.534] WbemLocator:IUnknown:Release (This=0xad5d204) returned 0x0 [0041.594] IUnknown:Release (This=0x2fe880) returned 0x0 [0051.870] RegCloseKey (hKey=0x33c) returned 0x0 [0057.343] CloseHandle (hObject=0x4b0) returned 1 Thread: id = 4 os_tid = 0xa30 Thread: id = 5 os_tid = 0xa44 [0032.566] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0032.567] CoGetContextToken (in: pToken=0x4e1f5ec | out: pToken=0x4e1f5ec) returned 0x0 [0032.567] CObjectContext::QueryInterface () returned 0x0 [0032.567] CObjectContext::GetCurrentThreadType () returned 0x0 [0032.567] Release () returned 0x0 [0032.567] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0032.567] CoUninitialize () Thread: id = 6 os_tid = 0xa48 [0032.569] CoGetContextToken (in: pToken=0xd5fb7c | out: pToken=0xd5fb7c) returned 0x0 [0032.569] CObjectContext::QueryInterface () returned 0x0 [0032.569] CObjectContext::GetCurrentThreadType () returned 0x0 [0032.569] Release () returned 0x0 [0032.569] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0032.569] SleepEx (dwMilliseconds=0xffffffff, bAlertable=1) returned 0xc0 [0032.582] SleepEx (dwMilliseconds=0x3a98, bAlertable=1) returned 0x0 [0047.366] SleepEx (dwMilliseconds=0x1379, bAlertable=1) returned 0x0 [0053.474] SleepEx (dwMilliseconds=0xffffffff, bAlertable=1) returned 0xc0 [0055.727] SleepEx (dwMilliseconds=0x3a98, bAlertable=1) returned 0x0 [0067.262] SleepEx (dwMilliseconds=0x1379, bAlertable=1) returned 0x0 [0072.258] SleepEx (dwMilliseconds=0xffffffff, bAlertable=1) returned 0xc0 [0072.258] SleepEx (dwMilliseconds=0x3a98, bAlertable=1) returned 0x0 [0082.263] SleepEx (dwMilliseconds=0x1379, bAlertable=1) Thread: id = 7 os_tid = 0xa4c [0032.676] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0034.895] CoTaskMemAlloc (cb=0x20c) returned 0x341d78 [0034.895] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x341d78 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.895] CoTaskMemFree (pv=0x341d78) [0034.895] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x508ec20, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0034.896] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x508ec34, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31 [0034.920] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe", nBufferLength=0x105, lpBuffer=0x508ebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe", lpFilePart=0x0) returned 0x2b [0035.163] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0", ulOptions=0x0, samDesired=0x20019, phkResult=0x508ee98 | out: phkResult=0x508ee98*=0x0) returned 0x2 [0035.168] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\Description\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x508ee98 | out: phkResult=0x508ee98*=0x264) returned 0x0 [0035.169] RegQueryValueExW (in: hKey=0x264, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x508eeb0, lpData=0x0, lpcbData=0x508eeac*=0x0 | out: lpType=0x508eeb0*=0x7, lpData=0x0, lpcbData=0x508eeac*=0x8c) returned 0x0 [0035.169] RegQueryValueExW (in: hKey=0x264, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x508eeb0, lpData=0x2863a2c, lpcbData=0x508eeac*=0x8c | out: lpType=0x508eeb0*=0x7, lpData=0x2863a2c*, lpcbData=0x508eeac*=0x8c) returned 0x0 [0035.170] RegQueryValueExW (in: hKey=0x264, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x508eee8, lpData=0x0, lpcbData=0x508eee4*=0x0 | out: lpType=0x508eee8*=0x7, lpData=0x0, lpcbData=0x508eee4*=0x8c) returned 0x0 [0035.204] RegQueryValueExW (in: hKey=0x264, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x508eee8, lpData=0x0, lpcbData=0x508eee4*=0x0 | out: lpType=0x508eee8*=0x7, lpData=0x0, lpcbData=0x508eee4*=0x8c) returned 0x0 [0035.228] RegQueryValueExW (in: hKey=0x264, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x508eee8, lpData=0x0, lpcbData=0x508eee4*=0x0 | out: lpType=0x508eee8*=0x7, lpData=0x0, lpcbData=0x508eee4*=0x8c) returned 0x0 [0035.228] RegQueryValueExW (in: hKey=0x264, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x508eee8, lpData=0x0, lpcbData=0x508eee4*=0x0 | out: lpType=0x508eee8*=0x7, lpData=0x0, lpcbData=0x508eee4*=0x8c) returned 0x0 [0035.256] RegQueryValueExW (in: hKey=0x264, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x508eee8, lpData=0x0, lpcbData=0x508eee4*=0x0 | out: lpType=0x508eee8*=0x7, lpData=0x0, lpcbData=0x508eee4*=0x8c) returned 0x0 [0035.256] RegQueryValueExW (in: hKey=0x264, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x508eee8, lpData=0x0, lpcbData=0x508eee4*=0x0 | out: lpType=0x508eee8*=0x7, lpData=0x0, lpcbData=0x508eee4*=0x8c) returned 0x0 [0035.317] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\Description\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x508ee98 | out: phkResult=0x508ee98*=0x1d4) returned 0x0 [0035.317] RegQueryValueExW (in: hKey=0x1d4, lpValueName="VideoBiosVersion", lpReserved=0x0, lpType=0x508eeb0, lpData=0x0, lpcbData=0x508eeac*=0x0 | out: lpType=0x508eeb0*=0x0, lpData=0x0, lpcbData=0x508eeac*=0x0) returned 0x2 [0035.317] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Oracle\\VirtualBox Guest Additions", ulOptions=0x0, samDesired=0x20019, phkResult=0x508ee98 | out: phkResult=0x508ee98*=0x0) returned 0x2 [0035.323] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\drivers\\VBoxMouse.sys" (normalized: "c:\\windows\\system32\\drivers\\vboxmouse.sys")) returned 0xffffffff [0035.325] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0", ulOptions=0x0, samDesired=0x20019, phkResult=0x508ee98 | out: phkResult=0x508ee98*=0x0) returned 0x2 [0035.325] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\VMware, Inc.\\VMware Tools", ulOptions=0x0, samDesired=0x20019, phkResult=0x508ee98 | out: phkResult=0x508ee98*=0x0) returned 0x2 [0035.326] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 1\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0", ulOptions=0x0, samDesired=0x20019, phkResult=0x508ee98 | out: phkResult=0x508ee98*=0x0) returned 0x2 [0035.326] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 2\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0", ulOptions=0x0, samDesired=0x20019, phkResult=0x508ee98 | out: phkResult=0x508ee98*=0x0) returned 0x2 [0035.327] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\ControlSet001\\Services\\Disk\\Enum", ulOptions=0x0, samDesired=0x20019, phkResult=0x508ee98 | out: phkResult=0x508ee98*=0x1f8) returned 0x0 [0035.327] RegQueryValueExW (in: hKey=0x1f8, lpValueName="0", lpReserved=0x0, lpType=0x508eeb0, lpData=0x0, lpcbData=0x508eeac*=0x0 | out: lpType=0x508eeb0*=0x1, lpData=0x0, lpcbData=0x508eeac*=0x98) returned 0x0 [0035.327] RegQueryValueExW (in: hKey=0x1f8, lpValueName="0", lpReserved=0x0, lpType=0x508eeb0, lpData=0x2865d44, lpcbData=0x508eeac*=0x98 | out: lpType=0x508eeb0*=0x1, lpData="IDE\\DiskHD502HI_________________________________OF90____\\5&37d1a386&0&0.0.0", lpcbData=0x508eeac*=0x98) returned 0x0 [0035.327] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000", ulOptions=0x0, samDesired=0x20019, phkResult=0x508ee98 | out: phkResult=0x508ee98*=0x1e4) returned 0x0 [0035.328] RegQueryValueExW (in: hKey=0x1e4, lpValueName="DriverDesc", lpReserved=0x0, lpType=0x508eeb0, lpData=0x0, lpcbData=0x508eeac*=0x0 | out: lpType=0x508eeb0*=0x1, lpData=0x0, lpcbData=0x508eeac*=0x3c) returned 0x0 [0035.328] RegQueryValueExW (in: hKey=0x1e4, lpValueName="DriverDesc", lpReserved=0x0, lpType=0x508eeb0, lpData=0x28662f0, lpcbData=0x508eeac*=0x3c | out: lpType=0x508eeb0*=0x1, lpData="Standard VGA Graphics Adapter", lpcbData=0x508eeac*=0x3c) returned 0x0 [0035.328] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x508ee98 | out: phkResult=0x508ee98*=0x1fc) returned 0x0 [0035.328] RegQueryValueExW (in: hKey=0x1fc, lpValueName="Device Description", lpReserved=0x0, lpType=0x508eeb0, lpData=0x0, lpcbData=0x508eeac*=0x0 | out: lpType=0x508eeb0*=0x1, lpData=0x0, lpcbData=0x508eeac*=0x3c) returned 0x0 [0035.328] RegQueryValueExW (in: hKey=0x1fc, lpValueName="Device Description", lpReserved=0x0, lpType=0x508eeb0, lpData=0x28667e0, lpcbData=0x508eeac*=0x3c | out: lpType=0x508eeb0*=0x1, lpData="Standard VGA Graphics Adapter", lpcbData=0x508eeac*=0x3c) returned 0x0 [0035.329] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\VMware, Inc.\\VMware Tools", ulOptions=0x0, samDesired=0x20019, phkResult=0x508ee98 | out: phkResult=0x508ee98*=0x0) returned 0x2 [0035.329] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\drivers\\vmmouse.sys" (normalized: "c:\\windows\\system32\\drivers\\vmmouse.sys")) returned 0xffffffff [0035.329] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\drivers\\vmhgfs.sys" (normalized: "c:\\windows\\system32\\drivers\\vmhgfs.sys")) returned 0xffffffff [0035.341] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0035.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wine_get_unix_file_name", cchWideChar=23, lpMultiByteStr=0x508eea0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wine_get_unix_file_nametU\x0c\x8e", lpUsedDefaultChar=0x0) returned 23 [0035.351] GetProcAddress (hModule=0x76c20000, lpProcName="wine_get_unix_file_name") returned 0x0 [0035.352] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0", ulOptions=0x0, samDesired=0x20019, phkResult=0x508ee98 | out: phkResult=0x508ee98*=0x0) returned 0x2 [0035.352] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\Description\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x508ee98 | out: phkResult=0x508ee98*=0x1e8) returned 0x0 [0035.352] RegQueryValueExW (in: hKey=0x1e8, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x508eeb0, lpData=0x0, lpcbData=0x508eeac*=0x0 | out: lpType=0x508eeb0*=0x7, lpData=0x0, lpcbData=0x508eeac*=0x8c) returned 0x0 [0035.352] RegQueryValueExW (in: hKey=0x1e8, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x508eeb0, lpData=0x286807c, lpcbData=0x508eeac*=0x8c | out: lpType=0x508eeb0*=0x7, lpData=0x286807c*, lpcbData=0x508eeac*=0x8c) returned 0x0 [0035.352] RegQueryValueExW (in: hKey=0x1e8, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x508eee8, lpData=0x0, lpcbData=0x508eee4*=0x0 | out: lpType=0x508eee8*=0x7, lpData=0x0, lpcbData=0x508eee4*=0x8c) returned 0x0 [0035.352] RegQueryValueExW (in: hKey=0x1e8, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x508eee8, lpData=0x0, lpcbData=0x508eee4*=0x0 | out: lpType=0x508eee8*=0x7, lpData=0x0, lpcbData=0x508eee4*=0x8c) returned 0x0 [0035.352] RegQueryValueExW (in: hKey=0x1e8, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x508eee8, lpData=0x0, lpcbData=0x508eee4*=0x0 | out: lpType=0x508eee8*=0x7, lpData=0x0, lpcbData=0x508eee4*=0x8c) returned 0x0 [0035.353] RegQueryValueExW (in: hKey=0x1e8, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x508eee8, lpData=0x0, lpcbData=0x508eee4*=0x0 | out: lpType=0x508eee8*=0x7, lpData=0x0, lpcbData=0x508eee4*=0x8c) returned 0x0 [0035.353] RegQueryValueExW (in: hKey=0x1e8, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x508eee8, lpData=0x0, lpcbData=0x508eee4*=0x0 | out: lpType=0x508eee8*=0x7, lpData=0x0, lpcbData=0x508eee4*=0x8c) returned 0x0 [0035.353] RegQueryValueExW (in: hKey=0x1e8, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x508eee8, lpData=0x0, lpcbData=0x508eee4*=0x0 | out: lpType=0x508eee8*=0x7, lpData=0x0, lpcbData=0x508eee4*=0x8c) returned 0x0 [0035.375] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x1ec [0035.381] CoGetObjectContext (in: riid=0x286848c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x508eea8 | out: ppv=0x508eea8*=0x2fe88c) returned 0x0 [0035.502] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x508e138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0035.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", cchWideChar=63, lpMultiByteStr=0x508e638, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", lpUsedDefaultChar=0x0) returned 63 [0035.508] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll") returned 0x73da0000 [0035.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResetSecurity", cchWideChar=13, lpMultiByteStr=0x508e66c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResetSecurity\x1aèsò4Ä»\x94Âðs0é\x08\x05ør3", lpUsedDefaultChar=0x0) returned 13 [0035.592] GetProcAddress (hModule=0x73da0000, lpProcName="ResetSecurity") returned 0x73da24de [0035.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetSecurity", cchWideChar=11, lpMultiByteStr=0x508e66c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetSecurity", lpUsedDefaultChar=0x0) returned 11 [0035.599] GetProcAddress (hModule=0x73da0000, lpProcName="SetSecurity") returned 0x73da2520 [0035.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServices", cchWideChar=18, lpMultiByteStr=0x508e668, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesèsò4Ä»\x94Âðs0é\x08\x05", lpUsedDefaultChar=0x0) returned 18 [0035.606] GetProcAddress (hModule=0x73da0000, lpProcName="BlessIWbemServices") returned 0x73da1c69 [0035.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x508e660, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObjectD\x1aèsò4Ä»\x94Âðs0é\x08\x05", lpUsedDefaultChar=0x0) returned 24 [0035.623] GetProcAddress (hModule=0x73da0000, lpProcName="BlessIWbemServicesObject") returned 0x73da1cbb [0035.661] IComThreadingInfo:GetCurrentApartmentType (in: This=0x2fe88c, pAptType=0x508eea0 | out: pAptType=0x508eea0*=1) returned 0x0 [0035.664] IUnknown:QueryInterface (in: This=0x2fe88c, riid=0x2868474*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x508eea4 | out: ppvObject=0x508eea4*=0x0) returned 0x80004002 [0035.664] IUnknown:Release (This=0x2fe88c) returned 0x0 [0035.676] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x508eafc | out: lpiid=0x508eafc) returned 0x0 [0035.678] CoGetClassObject (in: rclsid=0x2ea964*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x73fad1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x508e810 | out: ppv=0x508e810*=0xad50810) returned 0x0 [0036.315] WbemDefPath:IUnknown:QueryInterface (in: This=0xad50810, riid=0x73fe0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x508ea28 | out: ppvObject=0x508ea28*=0x0) returned 0x80004002 [0036.315] WbemDefPath:IClassFactory:CreateInstance (in: This=0xad50810, pUnkOuter=0x0, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508ea3c | out: ppvObject=0x508ea3c*=0xad50820) returned 0x0 [0036.315] WbemDefPath:IUnknown:Release (This=0xad50810) returned 0x0 [0036.315] WbemDefPath:IUnknown:QueryInterface (in: This=0xad50820, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508e65c | out: ppvObject=0x508e65c*=0xad50820) returned 0x0 [0036.316] WbemDefPath:IUnknown:QueryInterface (in: This=0xad50820, riid=0x7404fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x508e618 | out: ppvObject=0x508e618*=0x0) returned 0x80004002 [0036.316] WbemDefPath:IUnknown:AddRef (This=0xad50820) returned 0x3 [0036.316] WbemDefPath:IUnknown:QueryInterface (in: This=0xad50820, riid=0x7404f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x508df74 | out: ppvObject=0x508df74*=0x0) returned 0x80004002 [0036.316] WbemDefPath:IUnknown:QueryInterface (in: This=0xad50820, riid=0x7404f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x508df24 | out: ppvObject=0x508df24*=0x0) returned 0x80004002 [0036.316] WbemDefPath:IUnknown:QueryInterface (in: This=0xad50820, riid=0x7403c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508df30 | out: ppvObject=0x508df30*=0x344cf8) returned 0x0 [0036.317] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x344cf8, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x508df38 | out: pCid=0x508df38*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0036.317] WbemDefPath:IUnknown:Release (This=0x344cf8) returned 0x3 [0036.317] CoGetContextToken (in: pToken=0x508df90 | out: pToken=0x508df90) returned 0x0 [0036.317] CoGetContextToken (in: pToken=0x508e398 | out: pToken=0x508e398) returned 0x0 [0036.317] WbemDefPath:IUnknown:QueryInterface (in: This=0xad50820, riid=0x7404fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508e428 | out: ppvObject=0x508e428*=0x0) returned 0x80004002 [0036.317] WbemDefPath:IUnknown:Release (This=0xad50820) returned 0x2 [0036.317] WbemDefPath:IUnknown:Release (This=0xad50820) returned 0x1 [0036.317] CoGetContextToken (in: pToken=0x508ed20 | out: pToken=0x508ed20) returned 0x0 [0036.317] CoGetContextToken (in: pToken=0x508ec80 | out: pToken=0x508ec80) returned 0x0 [0036.317] WbemDefPath:IUnknown:QueryInterface (in: This=0xad50820, riid=0x508ed50*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x508ed4c | out: ppvObject=0x508ed4c*=0xad50820) returned 0x0 [0036.318] WbemDefPath:IUnknown:AddRef (This=0xad50820) returned 0x3 [0036.318] WbemDefPath:IUnknown:Release (This=0xad50820) returned 0x2 [0036.337] WbemDefPath:IWbemPath:SetText (This=0xad50820, uMode=0x4, pszPath="\\\\.\\ROOT\\cimv2") returned 0x0 [0036.349] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xad50820, puCount=0x508eed0 | out: puCount=0x508eed0*=0x2) returned 0x0 [0036.349] WbemDefPath:IWbemPath:GetText (in: This=0xad50820, lFlags=4, puBuffLength=0x508eecc*=0x0, pszText=0x0 | out: puBuffLength=0x508eecc*=0xf, pszText=0x0) returned 0x0 [0036.349] WbemDefPath:IWbemPath:GetText (in: This=0xad50820, lFlags=4, puBuffLength=0x508eecc*=0xf, pszText="00000000000000" | out: puBuffLength=0x508eecc*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0 [0036.366] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xad50820, puCount=0x508eeb8 | out: puCount=0x508eeb8*=0x2) returned 0x0 [0036.366] WbemDefPath:IWbemPath:GetText (in: This=0xad50820, lFlags=4, puBuffLength=0x508eeb4*=0x0, pszText=0x0 | out: puBuffLength=0x508eeb4*=0xf, pszText=0x0) returned 0x0 [0036.366] WbemDefPath:IWbemPath:GetText (in: This=0xad50820, lFlags=4, puBuffLength=0x508eeb4*=0xf, pszText="00000000000000" | out: puBuffLength=0x508eeb4*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0 [0036.372] CoGetObjectContext (in: riid=0x286848c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x508ee48 | out: ppv=0x508ee48*=0x2fe88c) returned 0x0 [0036.373] IComThreadingInfo:GetCurrentApartmentType (in: This=0x2fe88c, pAptType=0x508ee40 | out: pAptType=0x508ee40*=1) returned 0x0 [0036.373] IUnknown:QueryInterface (in: This=0x2fe88c, riid=0x2868474*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x508ee44 | out: ppvObject=0x508ee44*=0x0) returned 0x80004002 [0036.373] IUnknown:Release (This=0x2fe88c) returned 0x0 [0036.373] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x508ed54 | out: lpiid=0x508ed54) returned 0x0 [0036.374] CoGetClassObject (in: rclsid=0x355cec*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x73fad1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x508ea68 | out: ppv=0x508ea68*=0xad508e0) returned 0x0 [0036.458] WbemLocator:IUnknown:QueryInterface (in: This=0xad508e0, riid=0x73fe0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x508ec80 | out: ppvObject=0x508ec80*=0x0) returned 0x80004002 [0036.458] WbemLocator:IClassFactory:CreateInstance (in: This=0xad508e0, pUnkOuter=0x0, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508ec94 | out: ppvObject=0x508ec94*=0xad50a00) returned 0x0 [0036.458] WbemLocator:IUnknown:Release (This=0xad508e0) returned 0x0 [0036.458] WbemLocator:IUnknown:QueryInterface (in: This=0xad50a00, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508e8b4 | out: ppvObject=0x508e8b4*=0xad50a00) returned 0x0 [0036.458] WbemLocator:IUnknown:QueryInterface (in: This=0xad50a00, riid=0x7404fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x508e870 | out: ppvObject=0x508e870*=0x0) returned 0x80004002 [0036.458] WbemLocator:IUnknown:AddRef (This=0xad50a00) returned 0x3 [0036.458] WbemLocator:IUnknown:QueryInterface (in: This=0xad50a00, riid=0x7404f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x508e1cc | out: ppvObject=0x508e1cc*=0x0) returned 0x80004002 [0036.458] WbemLocator:IUnknown:QueryInterface (in: This=0xad50a00, riid=0x7404f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x508e17c | out: ppvObject=0x508e17c*=0x0) returned 0x80004002 [0036.458] WbemLocator:IUnknown:QueryInterface (in: This=0xad50a00, riid=0x7403c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508e188 | out: ppvObject=0x508e188*=0x0) returned 0x80004002 [0036.458] CoGetContextToken (in: pToken=0x508e1e8 | out: pToken=0x508e1e8) returned 0x0 [0036.458] CoGetObjectContext (in: riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3557dc | out: ppv=0x3557dc*=0x2fe880) returned 0x0 [0036.458] CoGetContextToken (in: pToken=0x508e5f0 | out: pToken=0x508e5f0) returned 0x0 [0036.458] WbemLocator:IUnknown:QueryInterface (in: This=0xad50a00, riid=0x7404fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508e680 | out: ppvObject=0x508e680*=0x0) returned 0x80004002 [0036.459] WbemLocator:IUnknown:Release (This=0xad50a00) returned 0x2 [0036.459] WbemLocator:IUnknown:Release (This=0xad50a00) returned 0x1 [0036.470] CoGetContextToken (in: pToken=0x508ec60 | out: pToken=0x508ec60) returned 0x0 [0036.471] CoGetContextToken (in: pToken=0x508ebc0 | out: pToken=0x508ebc0) returned 0x0 [0036.471] WbemLocator:IUnknown:QueryInterface (in: This=0xad50a00, riid=0x508ec90*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x508ec8c | out: ppvObject=0x508ec8c*=0xad50a00) returned 0x0 [0036.471] WbemLocator:IUnknown:AddRef (This=0xad50a00) returned 0x3 [0036.471] WbemLocator:IUnknown:Release (This=0xad50a00) returned 0x2 [0036.483] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xad50820, puCount=0x508ee24 | out: puCount=0x508ee24*=0x2) returned 0x0 [0036.483] WbemDefPath:IWbemPath:GetText (in: This=0xad50820, lFlags=8, puBuffLength=0x508ee20*=0x0, pszText=0x0 | out: puBuffLength=0x508ee20*=0xf, pszText=0x0) returned 0x0 [0036.483] WbemDefPath:IWbemPath:GetText (in: This=0xad50820, lFlags=8, puBuffLength=0x508ee20*=0xf, pszText="00000000000000" | out: puBuffLength=0x508ee20*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0 [0036.484] CoCreateInstance (in: rclsid=0x73da1284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x73da12e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x508ecfc | out: ppv=0x508ecfc*=0xad50a10) returned 0x0 [0036.484] WbemLocator:IWbemLocator:ConnectServer (in: This=0xad50a10, strNetworkResource="\\\\.\\ROOT\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x508ed90 | out: ppNamespace=0x508ed90*=0xad5d204) returned 0x0 [0039.732] WbemLocator:IUnknown:QueryInterface (in: This=0xad5d204, riid=0x73da1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508ec2c | out: ppvObject=0x508ec2c*=0x35ab6c) returned 0x0 [0039.732] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x35ab6c, pProxy=0xad5d204, pAuthnSvc=0x508ec7c, pAuthzSvc=0x508ec78, pServerPrincName=0x508ec70, pAuthnLevel=0x508ec74, pImpLevel=0x508ec64, pAuthInfo=0x508ec68, pCapabilites=0x508ec6c | out: pAuthnSvc=0x508ec7c*=0xa, pAuthzSvc=0x508ec78*=0x0, pServerPrincName=0x508ec70, pAuthnLevel=0x508ec74*=0x6, pImpLevel=0x508ec64*=0x2, pAuthInfo=0x508ec68, pCapabilites=0x508ec6c*=0x1) returned 0x0 [0039.732] WbemLocator:IUnknown:Release (This=0x35ab6c) returned 0x1 [0039.732] WbemLocator:IUnknown:QueryInterface (in: This=0xad5d204, riid=0x73da10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508ec20 | out: ppvObject=0x508ec20*=0x35ab8c) returned 0x0 [0039.732] WbemLocator:IUnknown:QueryInterface (in: This=0xad5d204, riid=0x73da1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508ec1c | out: ppvObject=0x508ec1c*=0x35ab6c) returned 0x0 [0039.732] WbemLocator:IClientSecurity:SetBlanket (This=0x35ab6c, pProxy=0xad5d204, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0039.732] WbemLocator:IUnknown:Release (This=0x35ab6c) returned 0x2 [0039.733] WbemLocator:IUnknown:Release (This=0x35ab8c) returned 0x1 [0039.733] CoTaskMemFree (pv=0x355e90) [0039.733] WbemLocator:IUnknown:Release (This=0xad50a10) returned 0x0 [0039.733] WbemLocator:IUnknown:QueryInterface (in: This=0xad5d204, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508e81c | out: ppvObject=0x508e81c*=0x35ab8c) returned 0x0 [0039.733] WbemLocator:IUnknown:QueryInterface (in: This=0x35ab8c, riid=0x7404fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x508e7d8 | out: ppvObject=0x508e7d8*=0x0) returned 0x80004002 [0039.733] WbemLocator:IUnknown:QueryInterface (in: This=0x35ab8c, riid=0x7404fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x508e5f4 | out: ppvObject=0x508e5f4*=0x0) returned 0x80004002 [0039.734] WbemLocator:IUnknown:AddRef (This=0x35ab8c) returned 0x3 [0039.734] WbemLocator:IUnknown:QueryInterface (in: This=0x35ab8c, riid=0x7404f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x508e134 | out: ppvObject=0x508e134*=0x0) returned 0x80004002 [0039.734] WbemLocator:IUnknown:QueryInterface (in: This=0x35ab8c, riid=0x7404f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x508e0e4 | out: ppvObject=0x508e0e4*=0x0) returned 0x80004002 [0039.735] WbemLocator:IUnknown:QueryInterface (in: This=0x35ab8c, riid=0x7403c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508e0f0 | out: ppvObject=0x508e0f0*=0x35aaec) returned 0x0 [0039.735] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x35aaec, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x508e0f8 | out: pCid=0x508e0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0039.735] WbemLocator:IUnknown:Release (This=0x35aaec) returned 0x3 [0039.735] CoGetContextToken (in: pToken=0x508e150 | out: pToken=0x508e150) returned 0x0 [0039.735] CoGetContextToken (in: pToken=0x508e558 | out: pToken=0x508e558) returned 0x0 [0039.735] WbemLocator:IUnknown:QueryInterface (in: This=0x35ab8c, riid=0x7404fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508e5e8 | out: ppvObject=0x508e5e8*=0x35ab74) returned 0x0 [0039.735] WbemLocator:IRpcOptions:Query (in: This=0x35ab74, pPrx=0x35ab8c, dwProperty=2, pdwValue=0x508e610 | out: pdwValue=0x508e610) returned 0x80004002 [0039.735] WbemLocator:IUnknown:Release (This=0x35ab74) returned 0x3 [0039.735] WbemLocator:IUnknown:Release (This=0x35ab8c) returned 0x2 [0039.735] CoGetContextToken (in: pToken=0x508eb30 | out: pToken=0x508eb30) returned 0x0 [0039.735] CoGetContextToken (in: pToken=0x508ea90 | out: pToken=0x508ea90) returned 0x0 [0039.735] WbemLocator:IUnknown:QueryInterface (in: This=0x35ab8c, riid=0x508eb60*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x508eb5c | out: ppvObject=0x508eb5c*=0xad5d204) returned 0x0 [0039.735] WbemLocator:IUnknown:AddRef (This=0xad5d204) returned 0x4 [0039.736] WbemLocator:IUnknown:Release (This=0xad5d204) returned 0x3 [0039.736] WbemLocator:IUnknown:Release (This=0xad5d204) returned 0x2 [0039.742] SysStringLen (param_1=0x0) returned 0x0 [0039.749] CoGetContextToken (in: pToken=0x508eb28 | out: pToken=0x508eb28) returned 0x0 [0039.749] WbemLocator:IUnknown:AddRef (This=0x35ab8c) returned 0x3 [0039.749] WbemLocator:IUnknown:QueryInterface (in: This=0x35ab8c, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508e9bc | out: ppvObject=0x508e9bc*=0x35ab8c) returned 0x0 [0039.749] WbemLocator:IUnknown:Release (This=0x35ab8c) returned 0x3 [0039.749] WbemLocator:IUnknown:Release (This=0x35ab8c) returned 0x2 [0039.755] CoGetContextToken (in: pToken=0x508ec10 | out: pToken=0x508ec10) returned 0x0 [0039.755] WbemLocator:IUnknown:AddRef (This=0xad5d204) returned 0x3 [0039.755] IWbemServices:ExecQuery (in: This=0xad5d204, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_VideoController", lFlags=16, pCtx=0x0, ppEnum=0x508ee2c | out: ppEnum=0x508ee2c*=0xad5c934) returned 0x0 [0039.764] IUnknown:QueryInterface (in: This=0xad5c934, riid=0x73da1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508ec84 | out: ppvObject=0x508ec84*=0xad5c938) returned 0x0 [0039.764] IClientSecurity:QueryBlanket (in: This=0xad5c938, pProxy=0xad5c934, pAuthnSvc=0x508ecd4, pAuthzSvc=0x508ecd0, pServerPrincName=0x508ecc8, pAuthnLevel=0x508eccc, pImpLevel=0x508ecbc, pAuthInfo=0x508ecc0, pCapabilites=0x508ecc4 | out: pAuthnSvc=0x508ecd4*=0xa, pAuthzSvc=0x508ecd0*=0x0, pServerPrincName=0x508ecc8, pAuthnLevel=0x508eccc*=0x6, pImpLevel=0x508ecbc*=0x2, pAuthInfo=0x508ecc0, pCapabilites=0x508ecc4*=0x1) returned 0x0 [0039.764] IUnknown:Release (This=0xad5c938) returned 0x1 [0039.764] IUnknown:QueryInterface (in: This=0xad5c934, riid=0x73da10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508ec78 | out: ppvObject=0x508ec78*=0x35ccd4) returned 0x0 [0039.764] IUnknown:QueryInterface (in: This=0xad5c934, riid=0x73da1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508ec74 | out: ppvObject=0x508ec74*=0xad5c938) returned 0x0 [0039.764] IClientSecurity:SetBlanket (This=0xad5c938, pProxy=0xad5c934, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0039.796] IUnknown:Release (This=0xad5c938) returned 0x2 [0039.796] WbemLocator:IUnknown:Release (This=0x35ccd4) returned 0x1 [0039.796] CoTaskMemFree (pv=0x355ec0) [0039.796] IUnknown:QueryInterface (in: This=0xad5c934, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508e870 | out: ppvObject=0x508e870*=0x35ccd4) returned 0x0 [0039.796] WbemLocator:IUnknown:QueryInterface (in: This=0x35ccd4, riid=0x7404fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x508e82c | out: ppvObject=0x508e82c*=0x0) returned 0x80004002 [0039.797] WbemLocator:IUnknown:QueryInterface (in: This=0x35ccd4, riid=0x7404fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x508e64c | out: ppvObject=0x508e64c*=0x0) returned 0x80004002 [0039.797] WbemLocator:IUnknown:AddRef (This=0x35ccd4) returned 0x3 [0039.797] WbemLocator:IUnknown:QueryInterface (in: This=0x35ccd4, riid=0x7404f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x508e18c | out: ppvObject=0x508e18c*=0x0) returned 0x80004002 [0039.797] WbemLocator:IUnknown:QueryInterface (in: This=0x35ccd4, riid=0x7404f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x508e13c | out: ppvObject=0x508e13c*=0x0) returned 0x80004002 [0039.798] WbemLocator:IUnknown:QueryInterface (in: This=0x35ccd4, riid=0x7403c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508e148 | out: ppvObject=0x508e148*=0x35cc34) returned 0x0 [0039.798] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x35cc34, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x508e150 | out: pCid=0x508e150*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0039.798] WbemLocator:IUnknown:Release (This=0x35cc34) returned 0x3 [0039.798] CoGetContextToken (in: pToken=0x508e1a8 | out: pToken=0x508e1a8) returned 0x0 [0039.798] CoGetContextToken (in: pToken=0x508e5b0 | out: pToken=0x508e5b0) returned 0x0 [0039.798] WbemLocator:IUnknown:QueryInterface (in: This=0x35ccd4, riid=0x7404fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508e640 | out: ppvObject=0x508e640*=0x35ccbc) returned 0x0 [0039.798] WbemLocator:IRpcOptions:Query (in: This=0x35ccbc, pPrx=0x35ccd4, dwProperty=2, pdwValue=0x508e668 | out: pdwValue=0x508e668) returned 0x80004002 [0039.798] WbemLocator:IUnknown:Release (This=0x35ccbc) returned 0x3 [0039.798] WbemLocator:IUnknown:Release (This=0x35ccd4) returned 0x2 [0039.798] CoGetContextToken (in: pToken=0x508eb80 | out: pToken=0x508eb80) returned 0x0 [0039.798] CoGetContextToken (in: pToken=0x508eae0 | out: pToken=0x508eae0) returned 0x0 [0039.798] WbemLocator:IUnknown:QueryInterface (in: This=0x35ccd4, riid=0x508ebb0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x508ebac | out: ppvObject=0x508ebac*=0xad5c934) returned 0x0 [0039.798] IUnknown:AddRef (This=0xad5c934) returned 0x4 [0039.798] IUnknown:Release (This=0xad5c934) returned 0x3 [0039.798] IUnknown:Release (This=0xad5c934) returned 0x2 [0039.798] WbemLocator:IUnknown:Release (This=0xad5d204) returned 0x2 [0039.798] SysStringLen (param_1=0x0) returned 0x0 [0039.799] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xad50820, puCount=0x508ee78 | out: puCount=0x508ee78*=0x2) returned 0x0 [0039.799] WbemDefPath:IWbemPath:GetText (in: This=0xad50820, lFlags=4, puBuffLength=0x508ee74*=0x0, pszText=0x0 | out: puBuffLength=0x508ee74*=0xf, pszText=0x0) returned 0x0 [0039.799] WbemDefPath:IWbemPath:GetText (in: This=0xad50820, lFlags=4, puBuffLength=0x508ee74*=0xf, pszText="00000000000000" | out: puBuffLength=0x508ee74*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0 [0039.799] CoGetContextToken (in: pToken=0x508ecc8 | out: pToken=0x508ecc8) returned 0x0 [0039.799] IUnknown:AddRef (This=0xad5c934) returned 0x3 [0039.799] IEnumWbemClassObject:Clone (in: This=0xad5c934, ppEnum=0x508ee84 | out: ppEnum=0x508ee84*=0xad5d2a4) returned 0x0 [0039.800] IUnknown:QueryInterface (in: This=0xad5d2a4, riid=0x73da1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508ed48 | out: ppvObject=0x508ed48*=0xad5d2a8) returned 0x0 [0039.800] IClientSecurity:QueryBlanket (in: This=0xad5d2a8, pProxy=0xad5d2a4, pAuthnSvc=0x508ed98, pAuthzSvc=0x508ed94, pServerPrincName=0x508ed8c, pAuthnLevel=0x508ed90, pImpLevel=0x508ed80, pAuthInfo=0x508ed84, pCapabilites=0x508ed88 | out: pAuthnSvc=0x508ed98*=0xa, pAuthzSvc=0x508ed94*=0x0, pServerPrincName=0x508ed8c, pAuthnLevel=0x508ed90*=0x6, pImpLevel=0x508ed80*=0x2, pAuthInfo=0x508ed84, pCapabilites=0x508ed88*=0x1) returned 0x0 [0039.800] IUnknown:Release (This=0xad5d2a8) returned 0x1 [0039.800] IUnknown:QueryInterface (in: This=0xad5d2a4, riid=0x73da10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508ed3c | out: ppvObject=0x508ed3c*=0x35d9b4) returned 0x0 [0039.800] IUnknown:QueryInterface (in: This=0xad5d2a4, riid=0x73da1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508ed38 | out: ppvObject=0x508ed38*=0xad5d2a8) returned 0x0 [0039.800] IClientSecurity:SetBlanket (This=0xad5d2a8, pProxy=0xad5d2a4, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0039.802] IUnknown:Release (This=0xad5d2a8) returned 0x2 [0039.802] WbemLocator:IUnknown:Release (This=0x35d9b4) returned 0x1 [0039.802] CoTaskMemFree (pv=0x355e60) [0039.802] IUnknown:QueryInterface (in: This=0xad5d2a4, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508e924 | out: ppvObject=0x508e924*=0x35d9b4) returned 0x0 [0039.802] WbemLocator:IUnknown:QueryInterface (in: This=0x35d9b4, riid=0x7404fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x508e8e0 | out: ppvObject=0x508e8e0*=0x0) returned 0x80004002 [0039.802] WbemLocator:IUnknown:QueryInterface (in: This=0x35d9b4, riid=0x7404fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x508e6fc | out: ppvObject=0x508e6fc*=0x0) returned 0x80004002 [0039.803] WbemLocator:IUnknown:AddRef (This=0x35d9b4) returned 0x3 [0039.803] WbemLocator:IUnknown:QueryInterface (in: This=0x35d9b4, riid=0x7404f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x508e23c | out: ppvObject=0x508e23c*=0x0) returned 0x80004002 [0039.803] WbemLocator:IUnknown:QueryInterface (in: This=0x35d9b4, riid=0x7404f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x508e1ec | out: ppvObject=0x508e1ec*=0x0) returned 0x80004002 [0039.803] WbemLocator:IUnknown:QueryInterface (in: This=0x35d9b4, riid=0x7403c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508e1f8 | out: ppvObject=0x508e1f8*=0x35d914) returned 0x0 [0039.803] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x35d914, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x508e200 | out: pCid=0x508e200*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0039.803] WbemLocator:IUnknown:Release (This=0x35d914) returned 0x3 [0039.803] CoGetContextToken (in: pToken=0x508e258 | out: pToken=0x508e258) returned 0x0 [0039.804] CoGetContextToken (in: pToken=0x508e660 | out: pToken=0x508e660) returned 0x0 [0039.804] WbemLocator:IUnknown:QueryInterface (in: This=0x35d9b4, riid=0x7404fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508e6f0 | out: ppvObject=0x508e6f0*=0x35d99c) returned 0x0 [0039.804] WbemLocator:IRpcOptions:Query (in: This=0x35d99c, pPrx=0x35d9b4, dwProperty=2, pdwValue=0x508e718 | out: pdwValue=0x508e718) returned 0x80004002 [0039.804] WbemLocator:IUnknown:Release (This=0x35d99c) returned 0x3 [0039.804] WbemLocator:IUnknown:Release (This=0x35d9b4) returned 0x2 [0039.804] CoGetContextToken (in: pToken=0x508ec38 | out: pToken=0x508ec38) returned 0x0 [0039.804] CoGetContextToken (in: pToken=0x508eb98 | out: pToken=0x508eb98) returned 0x0 [0039.804] WbemLocator:IUnknown:QueryInterface (in: This=0x35d9b4, riid=0x508ec68*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x508ec64 | out: ppvObject=0x508ec64*=0xad5d2a4) returned 0x0 [0039.804] IUnknown:AddRef (This=0xad5d2a4) returned 0x4 [0039.804] IUnknown:Release (This=0xad5d2a4) returned 0x3 [0039.804] IUnknown:Release (This=0xad5d2a4) returned 0x2 [0039.804] IUnknown:Release (This=0xad5c934) returned 0x2 [0039.804] SysStringLen (param_1=0x0) returned 0x0 [0039.810] IEnumWbemClassObject:Reset (This=0xad5d2a4) returned 0x0 [0039.820] CoTaskMemAlloc (cb=0x4) returned 0x344dd8 [0039.821] IEnumWbemClassObject:Next (in: This=0xad5d2a4, lTimeout=-1, uCount=0x1, apObjects=0x344dd8, puReturned=0x286d938 | out: apObjects=0x344dd8*=0xad5d2e0, puReturned=0x286d938*=0x1) returned 0x0 [0040.406] IUnknown:QueryInterface (in: This=0xad5d2e0, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508e4e8 | out: ppvObject=0x508e4e8*=0xad5d2e0) returned 0x0 [0040.406] IUnknown:QueryInterface (in: This=0xad5d2e0, riid=0x7404fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x508e4a4 | out: ppvObject=0x508e4a4*=0x0) returned 0x80004002 [0040.407] IUnknown:QueryInterface (in: This=0xad5d2e0, riid=0x7404fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x508e2c4 | out: ppvObject=0x508e2c4*=0x0) returned 0x80004002 [0040.407] IUnknown:AddRef (This=0xad5d2e0) returned 0x3 [0040.407] IUnknown:QueryInterface (in: This=0xad5d2e0, riid=0x7404f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x508de04 | out: ppvObject=0x508de04*=0x0) returned 0x80004002 [0040.408] IUnknown:QueryInterface (in: This=0xad5d2e0, riid=0x7404f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x508ddb4 | out: ppvObject=0x508ddb4*=0x0) returned 0x80004002 [0040.408] IUnknown:QueryInterface (in: This=0xad5d2e0, riid=0x7403c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508ddc0 | out: ppvObject=0x508ddc0*=0xad5d2e4) returned 0x0 [0040.408] IMarshal:GetUnmarshalClass (in: This=0xad5d2e4, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x508ddc8 | out: pCid=0x508ddc8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0040.408] IUnknown:Release (This=0xad5d2e4) returned 0x3 [0040.408] CoGetContextToken (in: pToken=0x508de20 | out: pToken=0x508de20) returned 0x0 [0040.408] CoGetContextToken (in: pToken=0x508e228 | out: pToken=0x508e228) returned 0x0 [0040.408] IUnknown:QueryInterface (in: This=0xad5d2e0, riid=0x7404fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508e2b8 | out: ppvObject=0x508e2b8*=0x0) returned 0x80004002 [0040.408] IUnknown:Release (This=0xad5d2e0) returned 0x2 [0040.408] CoGetContextToken (in: pToken=0x508e7f8 | out: pToken=0x508e7f8) returned 0x0 [0040.408] CoGetContextToken (in: pToken=0x508e758 | out: pToken=0x508e758) returned 0x0 [0040.408] IUnknown:QueryInterface (in: This=0xad5d2e0, riid=0x508e828*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x508e824 | out: ppvObject=0x508e824*=0xad5d2e0) returned 0x0 [0040.408] IUnknown:AddRef (This=0xad5d2e0) returned 0x4 [0040.408] IUnknown:Release (This=0xad5d2e0) returned 0x3 [0040.408] IUnknown:Release (This=0xad5d2e0) returned 0x2 [0040.409] CoTaskMemFree (pv=0x344dd8) [0040.409] CoGetContextToken (in: pToken=0x508eb60 | out: pToken=0x508eb60) returned 0x0 [0040.409] IUnknown:AddRef (This=0xad5d2e0) returned 0x3 [0040.421] IWbemClassObject:Get (in: This=0xad5d2e0, wszName="__GENUS", lFlags=0, pVal=0x508ee74*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x508eef4*=0, plFlavor=0x508eef0*=0 | out: pVal=0x508ee74*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x508eef4*=3, plFlavor=0x508eef0*=64) returned 0x0 [0040.428] IWbemClassObject:Get (in: This=0xad5d2e0, wszName="__PATH", lFlags=0, pVal=0x508ee58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x508eedc*=0, plFlavor=0x508eed8*=0 | out: pVal=0x508ee58*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\cimv2:Win32_VideoController.DeviceID=\"VideoController1\"", varVal2=0x0), pType=0x508eedc*=8, plFlavor=0x508eed8*=64) returned 0x0 [0040.428] SysStringByteLen (bstr="\\\\XDUWTFONO\\ROOT\\cimv2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x90 [0040.428] SysStringByteLen (bstr="\\\\XDUWTFONO\\ROOT\\cimv2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x90 [0040.434] CoGetObjectContext (in: riid=0x286848c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x508ee84 | out: ppv=0x508ee84*=0x2fe88c) returned 0x0 [0040.434] IComThreadingInfo:GetCurrentApartmentType (in: This=0x2fe88c, pAptType=0x508ee7c | out: pAptType=0x508ee7c*=1) returned 0x0 [0040.434] IUnknown:QueryInterface (in: This=0x2fe88c, riid=0x2868474*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x508ee80 | out: ppvObject=0x508ee80*=0x0) returned 0x80004002 [0040.434] IUnknown:Release (This=0x2fe88c) returned 0x1 [0040.436] CoGetClassObject (in: rclsid=0x2ea964*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x73fad1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x508e7f0 | out: ppv=0x508e7f0*=0xad50a10) returned 0x0 [0040.436] WbemDefPath:IUnknown:QueryInterface (in: This=0xad50a10, riid=0x73fe0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x508ea08 | out: ppvObject=0x508ea08*=0x0) returned 0x80004002 [0040.436] WbemDefPath:IClassFactory:CreateInstance (in: This=0xad50a10, pUnkOuter=0x0, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508ea1c | out: ppvObject=0x508ea1c*=0xad63050) returned 0x0 [0040.436] WbemDefPath:IUnknown:Release (This=0xad50a10) returned 0x0 [0040.437] WbemDefPath:IUnknown:QueryInterface (in: This=0xad63050, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508e63c | out: ppvObject=0x508e63c*=0xad63050) returned 0x0 [0040.437] WbemDefPath:IUnknown:QueryInterface (in: This=0xad63050, riid=0x7404fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x508e5f8 | out: ppvObject=0x508e5f8*=0x0) returned 0x80004002 [0040.437] WbemDefPath:IUnknown:AddRef (This=0xad63050) returned 0x3 [0040.437] WbemDefPath:IUnknown:QueryInterface (in: This=0xad63050, riid=0x7404f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x508df54 | out: ppvObject=0x508df54*=0x0) returned 0x80004002 [0040.437] WbemDefPath:IUnknown:QueryInterface (in: This=0xad63050, riid=0x7404f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x508df04 | out: ppvObject=0x508df04*=0x0) returned 0x80004002 [0040.437] WbemDefPath:IUnknown:QueryInterface (in: This=0xad63050, riid=0x7403c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508df10 | out: ppvObject=0x508df10*=0x344dd8) returned 0x0 [0040.437] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x344dd8, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x508df18 | out: pCid=0x508df18*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0040.437] WbemDefPath:IUnknown:Release (This=0x344dd8) returned 0x3 [0040.437] CoGetContextToken (in: pToken=0x508df70 | out: pToken=0x508df70) returned 0x0 [0040.437] CoGetContextToken (in: pToken=0x508e378 | out: pToken=0x508e378) returned 0x0 [0040.437] WbemDefPath:IUnknown:QueryInterface (in: This=0xad63050, riid=0x7404fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508e408 | out: ppvObject=0x508e408*=0x0) returned 0x80004002 [0040.437] WbemDefPath:IUnknown:Release (This=0xad63050) returned 0x2 [0040.437] WbemDefPath:IUnknown:Release (This=0xad63050) returned 0x1 [0040.437] CoGetContextToken (in: pToken=0x508ed00 | out: pToken=0x508ed00) returned 0x0 [0040.437] CoGetContextToken (in: pToken=0x508ec60 | out: pToken=0x508ec60) returned 0x0 [0040.437] WbemDefPath:IUnknown:QueryInterface (in: This=0xad63050, riid=0x508ed30*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x508ed2c | out: ppvObject=0x508ed2c*=0xad63050) returned 0x0 [0040.437] WbemDefPath:IUnknown:AddRef (This=0xad63050) returned 0x3 [0040.437] WbemDefPath:IUnknown:Release (This=0xad63050) returned 0x2 [0040.437] WbemDefPath:IWbemPath:SetText (This=0xad63050, uMode=0x4, pszPath="\\\\XDUWTFONO\\ROOT\\cimv2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x0 [0040.438] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xad50820, puCount=0x508eeb0 | out: puCount=0x508eeb0*=0x2) returned 0x0 [0040.438] WbemDefPath:IWbemPath:GetText (in: This=0xad50820, lFlags=4, puBuffLength=0x508eeac*=0x0, pszText=0x0 | out: puBuffLength=0x508eeac*=0xf, pszText=0x0) returned 0x0 [0040.438] WbemDefPath:IWbemPath:GetText (in: This=0xad50820, lFlags=4, puBuffLength=0x508eeac*=0xf, pszText="00000000000000" | out: puBuffLength=0x508eeac*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0 [0040.491] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xad50820, puCount=0x508ee78 | out: puCount=0x508ee78*=0x2) returned 0x0 [0040.491] WbemDefPath:IWbemPath:GetText (in: This=0xad50820, lFlags=4, puBuffLength=0x508ee74*=0x0, pszText=0x0 | out: puBuffLength=0x508ee74*=0xf, pszText=0x0) returned 0x0 [0040.491] WbemDefPath:IWbemPath:GetText (in: This=0xad50820, lFlags=4, puBuffLength=0x508ee74*=0xf, pszText="00000000000000" | out: puBuffLength=0x508ee74*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0 [0040.491] IWbemClassObject:Get (in: This=0xad5d2e0, wszName="Description", lFlags=0, pVal=0x508ee74*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286e228*=0, plFlavor=0x286e22c*=0 | out: pVal=0x508ee74*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x286e228*=8, plFlavor=0x286e22c*=0) returned 0x0 [0040.491] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0040.491] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0040.491] IWbemClassObject:Get (in: This=0xad5d2e0, wszName="Description", lFlags=0, pVal=0x508ee7c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286e228*=8, plFlavor=0x286e22c*=0 | out: pVal=0x508ee7c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x286e228*=8, plFlavor=0x286e22c*=0) returned 0x0 [0040.491] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0040.491] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0040.501] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xad50820, puCount=0x508ee78 | out: puCount=0x508ee78*=0x2) returned 0x0 [0040.501] WbemDefPath:IWbemPath:GetText (in: This=0xad50820, lFlags=4, puBuffLength=0x508ee74*=0x0, pszText=0x0 | out: puBuffLength=0x508ee74*=0xf, pszText=0x0) returned 0x0 [0040.501] WbemDefPath:IWbemPath:GetText (in: This=0xad50820, lFlags=4, puBuffLength=0x508ee74*=0xf, pszText="00000000000000" | out: puBuffLength=0x508ee74*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0 [0040.502] IWbemClassObject:Get (in: This=0xad5d2e0, wszName="Description", lFlags=0, pVal=0x508ee74*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286e370*=0, plFlavor=0x286e374*=0 | out: pVal=0x508ee74*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x286e370*=8, plFlavor=0x286e374*=0) returned 0x0 [0040.502] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0040.502] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0040.502] IWbemClassObject:Get (in: This=0xad5d2e0, wszName="Description", lFlags=0, pVal=0x508ee7c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286e370*=8, plFlavor=0x286e374*=0 | out: pVal=0x508ee7c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x286e370*=8, plFlavor=0x286e374*=0) returned 0x0 [0040.502] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0040.502] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0040.502] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xad50820, puCount=0x508ee78 | out: puCount=0x508ee78*=0x2) returned 0x0 [0040.502] WbemDefPath:IWbemPath:GetText (in: This=0xad50820, lFlags=4, puBuffLength=0x508ee74*=0x0, pszText=0x0 | out: puBuffLength=0x508ee74*=0xf, pszText=0x0) returned 0x0 [0040.502] WbemDefPath:IWbemPath:GetText (in: This=0xad50820, lFlags=4, puBuffLength=0x508ee74*=0xf, pszText="00000000000000" | out: puBuffLength=0x508ee74*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0 [0040.503] IWbemClassObject:Get (in: This=0xad5d2e0, wszName="Description", lFlags=0, pVal=0x508ee74*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286e4a0*=0, plFlavor=0x286e4a4*=0 | out: pVal=0x508ee74*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x286e4a0*=8, plFlavor=0x286e4a4*=0) returned 0x0 [0040.503] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0040.503] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0040.503] IWbemClassObject:Get (in: This=0xad5d2e0, wszName="Description", lFlags=0, pVal=0x508ee7c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286e4a0*=8, plFlavor=0x286e4a4*=0 | out: pVal=0x508ee7c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x286e4a0*=8, plFlavor=0x286e4a4*=0) returned 0x0 [0040.503] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0040.503] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0040.503] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xad50820, puCount=0x508ee78 | out: puCount=0x508ee78*=0x2) returned 0x0 [0040.503] WbemDefPath:IWbemPath:GetText (in: This=0xad50820, lFlags=4, puBuffLength=0x508ee74*=0x0, pszText=0x0 | out: puBuffLength=0x508ee74*=0xf, pszText=0x0) returned 0x0 [0040.503] WbemDefPath:IWbemPath:GetText (in: This=0xad50820, lFlags=4, puBuffLength=0x508ee74*=0xf, pszText="00000000000000" | out: puBuffLength=0x508ee74*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0 [0040.503] IWbemClassObject:Get (in: This=0xad5d2e0, wszName="Description", lFlags=0, pVal=0x508ee74*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286e5ec*=0, plFlavor=0x286e5f0*=0 | out: pVal=0x508ee74*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x286e5ec*=8, plFlavor=0x286e5f0*=0) returned 0x0 [0040.503] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0040.503] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0040.503] IWbemClassObject:Get (in: This=0xad5d2e0, wszName="Description", lFlags=0, pVal=0x508ee7c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286e5ec*=8, plFlavor=0x286e5f0*=0 | out: pVal=0x508ee7c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x286e5ec*=8, plFlavor=0x286e5f0*=0) returned 0x0 [0040.503] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0040.503] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0040.503] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xad50820, puCount=0x508ee78 | out: puCount=0x508ee78*=0x2) returned 0x0 [0040.503] WbemDefPath:IWbemPath:GetText (in: This=0xad50820, lFlags=4, puBuffLength=0x508ee74*=0x0, pszText=0x0 | out: puBuffLength=0x508ee74*=0xf, pszText=0x0) returned 0x0 [0040.503] WbemDefPath:IWbemPath:GetText (in: This=0xad50820, lFlags=4, puBuffLength=0x508ee74*=0xf, pszText="00000000000000" | out: puBuffLength=0x508ee74*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0 [0040.504] IWbemClassObject:Get (in: This=0xad5d2e0, wszName="Description", lFlags=0, pVal=0x508ee74*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286e720*=0, plFlavor=0x286e724*=0 | out: pVal=0x508ee74*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x286e720*=8, plFlavor=0x286e724*=0) returned 0x0 [0040.504] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0040.504] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0040.504] IWbemClassObject:Get (in: This=0xad5d2e0, wszName="Description", lFlags=0, pVal=0x508ee7c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286e720*=8, plFlavor=0x286e724*=0 | out: pVal=0x508ee7c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x286e720*=8, plFlavor=0x286e724*=0) returned 0x0 [0040.504] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0040.504] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0040.504] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xad50820, puCount=0x508ee78 | out: puCount=0x508ee78*=0x2) returned 0x0 [0040.504] WbemDefPath:IWbemPath:GetText (in: This=0xad50820, lFlags=4, puBuffLength=0x508ee74*=0x0, pszText=0x0 | out: puBuffLength=0x508ee74*=0xf, pszText=0x0) returned 0x0 [0040.504] WbemDefPath:IWbemPath:GetText (in: This=0xad50820, lFlags=4, puBuffLength=0x508ee74*=0xf, pszText="00000000000000" | out: puBuffLength=0x508ee74*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0 [0040.504] IWbemClassObject:Get (in: This=0xad5d2e0, wszName="Description", lFlags=0, pVal=0x508ee74*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286e88c*=0, plFlavor=0x286e890*=0 | out: pVal=0x508ee74*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x286e88c*=8, plFlavor=0x286e890*=0) returned 0x0 [0040.504] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0040.504] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0040.504] IWbemClassObject:Get (in: This=0xad5d2e0, wszName="Description", lFlags=0, pVal=0x508ee7c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286e88c*=8, plFlavor=0x286e890*=0 | out: pVal=0x508ee7c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x286e88c*=8, plFlavor=0x286e890*=0) returned 0x0 [0040.504] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0040.504] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0040.505] CoTaskMemAlloc (cb=0x4) returned 0x344e28 [0040.505] IEnumWbemClassObject:Next (in: This=0xad5d2a4, lTimeout=-1, uCount=0x1, apObjects=0x344e28, puReturned=0x286d938 | out: apObjects=0x344e28*=0x0, puReturned=0x286d938*=0x0) returned 0x1 [0040.514] CoTaskMemFree (pv=0x344e28) [0040.515] CoGetContextToken (in: pToken=0x508edb0 | out: pToken=0x508edb0) returned 0x0 [0040.515] WbemLocator:IUnknown:Release (This=0x35d9b4) returned 0x1 [0040.515] IUnknown:Release (This=0xad5d2a4) returned 0x0 [0041.313] CoTaskMemAlloc (cb=0x20c) returned 0x35daa8 [0041.314] SHGetFolderPathW (in: hwnd=0x0, csidl=36, hToken=0x0, dwFlags=0x0, pszPath=0x35daa8 | out: pszPath="C:\\Windows") returned 0x0 [0041.316] CoTaskMemFree (pv=0x35daa8) [0041.316] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x508eb98, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0041.623] VirtualAlloc (lpAddress=0x0, dwSize=0x2205, flAllocationType=0x3000, flProtect=0x40) returned 0x940000 [0041.637] CoTaskMemAlloc (cb=0x20c) returned 0x35d5f8 [0041.637] SHGetFolderPathW (in: hwnd=0x0, csidl=36, hToken=0x0, dwFlags=0x0, pszPath=0x35d5f8 | out: pszPath="C:\\Windows") returned 0x0 [0041.637] CoTaskMemFree (pv=0x35d5f8) [0041.638] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x508eb2c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0041.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe", cchWideChar=56, lpMultiByteStr=0x508f050, cbMultiByte=58, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\x82I\x8e", lpUsedDefaultChar=0x0) returned 56 [0041.639] strlen (_Str="kernel32.dll") returned 0xc [0041.639] mbstowcs (in: _Dest=0x508cd18, _Source="kernel32.dll", _MaxCount=0xd | out: _Dest="kernel32.dll") returned 0xc [0041.639] strlen (_Str="KERNEL32.DLL") returned 0xc [0041.639] mbstowcs (in: _Dest=0x508cb10, _Source="KERNEL32.DLL", _MaxCount=0xd | out: _Dest="KERNEL32.DLL") returned 0xc [0041.639] strlen (_Str="\\KnownDlls32\\ntdll.dll") returned 0x16 [0041.639] mbstowcs (in: _Dest=0x508cf20, _Source="\\KnownDlls32\\ntdll.dll", _MaxCount=0x17 | out: _Dest="\\KnownDlls32\\ntdll.dll") returned 0x16 [0041.639] strlen (_Str="\\KnownDlls32\\advapi32.dll") returned 0x19 [0041.639] mbstowcs (in: _Dest=0x508d128, _Source="\\KnownDlls32\\advapi32.dll", _MaxCount=0x1a | out: _Dest="\\KnownDlls32\\advapi32.dll") returned 0x19 [0041.639] strlen (_Str="\\KnownDlls32\\kernel32.dll") returned 0x19 [0041.639] mbstowcs (in: _Dest=0x508e168, _Source="\\KnownDlls32\\kernel32.dll", _MaxCount=0x1a | out: _Dest="\\KnownDlls32\\kernel32.dll") returned 0x19 [0041.639] strlen (_Str="\\KnownDlls32\\user32.dll") returned 0x17 [0041.639] mbstowcs (in: _Dest=0x508df60, _Source="\\KnownDlls32\\user32.dll", _MaxCount=0x18 | out: _Dest="\\KnownDlls32\\user32.dll") returned 0x17 [0041.639] strlen (_Str="\\KnownDlls32\\Ole32.dll") returned 0x16 [0041.639] mbstowcs (in: _Dest=0x508d740, _Source="\\KnownDlls32\\Ole32.dll", _MaxCount=0x17 | out: _Dest="\\KnownDlls32\\Ole32.dll") returned 0x16 [0041.639] strlen (_Str="\\KnownDlls\\ntdll.dll") returned 0x14 [0041.639] mbstowcs (in: _Dest=0x508d948, _Source="\\KnownDlls\\ntdll.dll", _MaxCount=0x15 | out: _Dest="\\KnownDlls\\ntdll.dll") returned 0x14 [0041.639] strlen (_Str="\\KnownDlls\\advapi32.dll") returned 0x17 [0041.639] mbstowcs (in: _Dest=0x508dd58, _Source="\\KnownDlls\\advapi32.dll", _MaxCount=0x18 | out: _Dest="\\KnownDlls\\advapi32.dll") returned 0x17 [0041.639] strlen (_Str="\\KnownDlls\\kernel32.dll") returned 0x17 [0041.639] mbstowcs (in: _Dest=0x508d538, _Source="\\KnownDlls\\kernel32.dll", _MaxCount=0x18 | out: _Dest="\\KnownDlls\\kernel32.dll") returned 0x17 [0041.639] strlen (_Str="\\KnownDlls\\user32.dll") returned 0x15 [0041.639] mbstowcs (in: _Dest=0x508db50, _Source="\\KnownDlls\\user32.dll", _MaxCount=0x16 | out: _Dest="\\KnownDlls\\user32.dll") returned 0x15 [0041.639] strlen (_Str="\\KnownDlls\\Ole32.dll") returned 0x14 [0041.639] mbstowcs (in: _Dest=0x508d330, _Source="\\KnownDlls\\Ole32.dll", _MaxCount=0x15 | out: _Dest="\\KnownDlls\\Ole32.dll") returned 0x14 [0041.640] wcslen (_String="\\KnownDlls32\\advapi32.dll") returned 0x19 [0041.640] NtOpenSection (in: SectionHandle=0x508caec, DesiredAccess=0xc, ObjectAttributes=0x508ca9c*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\advapi32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x508caec*=0x264) returned 0x0 [0041.640] NtMapViewOfSection (in: SectionHandle=0x264, ProcessHandle=0xffffffff, BaseAddress=0x508caf4*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x508caf0*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x508caf4*=0x52b0000, SectionOffset=0x0, ViewSize=0x508caf0*=0xa0000) returned 0x40000003 [0041.640] wcslen (_String="\\KnownDlls32\\ntdll.dll") returned 0x16 [0041.640] NtOpenSection (in: SectionHandle=0x508caec, DesiredAccess=0xc, ObjectAttributes=0x508ca9c*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\ntdll.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x508caec*=0x1d4) returned 0x0 [0041.640] NtMapViewOfSection (in: SectionHandle=0x1d4, ProcessHandle=0xffffffff, BaseAddress=0x508caf4*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x508caf0*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x508caf4*=0x5350000, SectionOffset=0x0, ViewSize=0x508caf0*=0x180000) returned 0x40000003 [0041.640] wcslen (_String="\\KnownDlls32\\kernel32.dll") returned 0x19 [0041.640] NtOpenSection (in: SectionHandle=0x508caec, DesiredAccess=0xc, ObjectAttributes=0x508ca9c*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\kernel32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x508caec*=0x1f8) returned 0x0 [0041.640] NtMapViewOfSection (in: SectionHandle=0x1f8, ProcessHandle=0xffffffff, BaseAddress=0x508caf4*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x508caf0*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x508caf4*=0x54d0000, SectionOffset=0x0, ViewSize=0x508caf0*=0x110000) returned 0x40000003 [0041.641] wcslen (_String="\\KnownDlls32\\user32.dll") returned 0x17 [0041.641] NtOpenSection (in: SectionHandle=0x508caec, DesiredAccess=0xc, ObjectAttributes=0x508ca9c*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\user32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x508caec*=0x1e4) returned 0x0 [0041.641] NtMapViewOfSection (in: SectionHandle=0x1e4, ProcessHandle=0xffffffff, BaseAddress=0x508caf4*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x508caf0*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x508caf4*=0x55e0000, SectionOffset=0x0, ViewSize=0x508caf0*=0x100000) returned 0x40000003 [0041.641] wcslen (_String="\\KnownDlls32\\Ole32.dll") returned 0x16 [0041.641] NtOpenSection (in: SectionHandle=0x508caec, DesiredAccess=0xc, ObjectAttributes=0x508ca9c*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\Ole32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x508caec*=0x1fc) returned 0x0 [0041.641] NtMapViewOfSection (in: SectionHandle=0x1fc, ProcessHandle=0xffffffff, BaseAddress=0x508caf4*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x508caf0*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x508caf4*=0x56e0000, SectionOffset=0x0, ViewSize=0x508caf0*=0x15c000) returned 0x40000003 [0041.643] LoadLibraryA (lpLibFileName="Ole32.dll") returned 0x755e0000 [0041.643] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0041.643] GetProcAddress (hModule=0x74d40000, lpProcName="CryptAcquireContextW") returned 0x74d4df14 [0041.643] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0041.644] GetProcAddress (hModule=0x74d40000, lpProcName="CryptCreateHash") returned 0x74d4df4e [0041.644] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0041.644] GetProcAddress (hModule=0x74d40000, lpProcName="CryptDecrypt") returned 0x74d83178 [0041.644] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0041.644] GetProcAddress (hModule=0x74d40000, lpProcName="CryptDeriveKey") returned 0x74d83188 [0041.644] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0041.644] GetProcAddress (hModule=0x74d40000, lpProcName="CryptDestroyHash") returned 0x74d4df66 [0041.644] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0041.645] GetProcAddress (hModule=0x74d40000, lpProcName="CryptDestroyKey") returned 0x74d4c51a [0041.645] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0041.645] GetProcAddress (hModule=0x74d40000, lpProcName="CryptHashData") returned 0x74d4df36 [0041.645] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0041.645] GetProcAddress (hModule=0x74d40000, lpProcName="CryptReleaseContext") returned 0x74d4e124 [0041.647] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0041.647] GetProcAddress (hModule=0x74f40000, lpProcName="MessageBoxA") returned 0x74fafd1e [0041.647] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0041.647] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0041.647] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0041.647] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0041.648] GetProcAddress (hModule=0x755e0000, lpProcName="CoInitializeEx") returned 0x756209ad [0041.648] GetProcAddress (hModule=0x755e0000, lpProcName="CoCreateInstance") returned 0x75629d0b [0041.648] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0041.648] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexW") returned 0x76c3424c [0041.649] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="frenchy_shellcode_003") returned 0x1e8 [0041.649] strlen (_Str="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe") returned 0x38 [0041.649] strlen (_Str="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe") returned 0x38 [0041.649] mbstowcs (in: _Dest=0x508e410, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe", _MaxCount=0x39 | out: _Dest="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe") returned 0x38 [0041.649] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe", lpDst=0x508e8e8, nSize=0x104 | out: lpDst="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe") returned 0x39 [0041.649] CreateProcessW (in: lpApplicationName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x800000c, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x508e9f0*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x508ea70 | out: lpCommandLine=0x0, lpProcessInformation=0x508ea70*(hProcess=0x330, hThread=0x32c, dwProcessId=0xb14, dwThreadId=0xb18)) returned 1 [0041.666] NtQueryInformationProcess (in: ProcessHandle=0x330, ProcessInformationClass=0x0, ProcessInformation=0x508ea3c, ProcessInformationLength=0x18, ReturnLength=0x0 | out: ProcessInformation=0x508ea3c, ReturnLength=0x0) returned 0x0 [0041.666] NtReadVirtualMemory (in: ProcessHandle=0x330, BaseAddress=0x7efde008, Buffer=0x508ea90, NumberOfBytesToRead=0x4, NumberOfBytesRead=0x0 | out: Buffer=0x508ea90*, NumberOfBytesRead=0x0) returned 0x0 [0041.666] NtCreateSection (in: SectionHandle=0x508ea68, DesiredAccess=0xf001f, ObjectAttributes=0x0, MaximumSize=0x508ea58, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x508ea68*=0x338) returned 0x0 [0041.666] NtMapViewOfSection (in: SectionHandle=0x338, ProcessHandle=0xffffffff, BaseAddress=0x508ea84*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x508ea60*=0x8e000, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x508ea84*=0x5840000, SectionOffset=0x0, ViewSize=0x508ea60*=0x8e000) returned 0x0 [0041.666] NtMapViewOfSection (in: SectionHandle=0x338, ProcessHandle=0x330, BaseAddress=0x508ea80*=0x400000, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x508ea64*=0x8e000, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x508ea80*=0x400000, SectionOffset=0x0, ViewSize=0x508ea64*=0x8e000) returned 0x0 [0041.672] NtWriteVirtualMemory (in: ProcessHandle=0x330, BaseAddress=0x7efde008, Buffer=0x508ea80*, NumberOfBytesToWrite=0x4, NumberOfBytesWritten=0x508ea54 | out: Buffer=0x508ea80*, NumberOfBytesWritten=0x508ea54*=0x4) returned 0x0 [0041.672] NtGetContextThread (in: ThreadHandle=0x32c, Context=0x508e618 | out: Context=0x508e618*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0xd7ccba, Ebp=0x0, Eip=0x771401c4, SegCs=0x23, EFlags=0x202, Esp=0x3fffa8, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0041.672] NtSetContextThread (ThreadHandle=0x32c, Context=0x508e618*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x407e8e, Ebp=0x0, Eip=0x771401c4, SegCs=0x23, EFlags=0x202, Esp=0x3fffa8, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0041.673] NtResumeThread (in: ThreadHandle=0x32c, SuspendCount=0x0 | out: SuspendCount=0x0) returned 0x0 [0041.746] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\java.exe", nBufferLength=0x105, lpBuffer=0x508ec34, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\java.exe", lpFilePart=0x0) returned 0x39 [0041.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x508f094) returned 1 [0041.746] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\java.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\java.exe"), fInfoLevelId=0x0, lpFileInformation=0x508f110 | out: lpFileInformation=0x508f110*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0041.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x508f090) returned 1 [0041.747] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe", nBufferLength=0x105, lpBuffer=0x508ebe8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe", lpFilePart=0x0) returned 0x2b [0041.747] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\java.exe", nBufferLength=0x105, lpBuffer=0x508ebe8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\java.exe", lpFilePart=0x0) returned 0x39 [0041.747] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\java.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\java.exe"), bFailIfExists=1) returned 1 [0041.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\\\java.exe:Zone.Identifier", cchWideChar=74, lpMultiByteStr=0x508f0b0, cbMultiByte=76, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\\\java.exe:Zone.Identifier\x8e", lpUsedDefaultChar=0x0) returned 74 [0041.840] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\\\java.exe:Zone.Identifier" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\java.exe:zone.identifier")) returned 0 [0041.851] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x508f0d0 | out: phkResult=0x508f0d0*=0x33c) returned 0x0 [0041.851] RegQueryValueExW (in: hKey=0x33c, lpValueName="java", lpReserved=0x0, lpType=0x508f0cc, lpData=0x0, lpcbData=0x508f0c8*=0x0 | out: lpType=0x508f0cc*=0x0, lpData=0x0, lpcbData=0x508f0c8*=0x0) returned 0x2 [0041.852] RegSetValueExW (in: hKey=0x33c, lpValueName="java", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\\\java.exe", cbData=0x76 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\\\java.exe") returned 0x0 [0041.852] CoTaskMemAlloc (cb=0x20c) returned 0x35d5f8 [0041.852] SHGetFolderPathW (in: hwnd=0x0, csidl=36, hToken=0x0, dwFlags=0x0, pszPath=0x35d5f8 | out: pszPath="C:\\Windows") returned 0x0 [0041.852] CoTaskMemFree (pv=0x35d5f8) [0041.852] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x508eb98, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0041.853] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe", nBufferLength=0x105, lpBuffer=0x508ec34, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe", lpFilePart=0x0) returned 0x38 [0041.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x508f094) returned 1 [0041.853] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\regasm.exe"), fInfoLevelId=0x0, lpFileInformation=0x508f110 | out: lpFileInformation=0x508f110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5f591240, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xfa98)) returned 1 [0041.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x508f090) returned 1 [0041.854] SleepEx (dwMilliseconds=0x2710, bAlertable=1) returned 0x0 [0051.904] VirtualAlloc (lpAddress=0x0, dwSize=0x2205, flAllocationType=0x3000, flProtect=0x40) returned 0x950000 [0051.904] LocalAlloc (uFlags=0x0, uBytes=0x33e00) returned 0x35db88 [0051.905] CoTaskMemAlloc (cb=0x20c) returned 0x35d5f8 [0051.905] SHGetFolderPathW (in: hwnd=0x0, csidl=36, hToken=0x0, dwFlags=0x0, pszPath=0x35d5f8 | out: pszPath="C:\\Windows") returned 0x0 [0051.905] CoTaskMemFree (pv=0x35d5f8) [0051.905] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x508eb2c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0051.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe", cchWideChar=56, lpMultiByteStr=0x508f050, cbMultiByte=58, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\x82I\x8e", lpUsedDefaultChar=0x0) returned 56 [0051.905] strlen (_Str="kernel32.dll") returned 0xc [0051.905] mbstowcs (in: _Dest=0x508cd18, _Source="kernel32.dll", _MaxCount=0xd | out: _Dest="kernel32.dll") returned 0xc [0051.905] strlen (_Str="KERNEL32.DLL") returned 0xc [0051.905] mbstowcs (in: _Dest=0x508cb10, _Source="KERNEL32.DLL", _MaxCount=0xd | out: _Dest="KERNEL32.DLL") returned 0xc [0051.905] strlen (_Str="\\KnownDlls32\\ntdll.dll") returned 0x16 [0051.905] mbstowcs (in: _Dest=0x508cf20, _Source="\\KnownDlls32\\ntdll.dll", _MaxCount=0x17 | out: _Dest="\\KnownDlls32\\ntdll.dll") returned 0x16 [0051.910] strlen (_Str="\\KnownDlls32\\advapi32.dll") returned 0x19 [0051.910] mbstowcs (in: _Dest=0x508d128, _Source="\\KnownDlls32\\advapi32.dll", _MaxCount=0x1a | out: _Dest="\\KnownDlls32\\advapi32.dll") returned 0x19 [0051.910] strlen (_Str="\\KnownDlls32\\kernel32.dll") returned 0x19 [0051.910] mbstowcs (in: _Dest=0x508e168, _Source="\\KnownDlls32\\kernel32.dll", _MaxCount=0x1a | out: _Dest="\\KnownDlls32\\kernel32.dll") returned 0x19 [0051.910] strlen (_Str="\\KnownDlls32\\user32.dll") returned 0x17 [0051.910] mbstowcs (in: _Dest=0x508df60, _Source="\\KnownDlls32\\user32.dll", _MaxCount=0x18 | out: _Dest="\\KnownDlls32\\user32.dll") returned 0x17 [0051.910] strlen (_Str="\\KnownDlls32\\Ole32.dll") returned 0x16 [0051.910] mbstowcs (in: _Dest=0x508d740, _Source="\\KnownDlls32\\Ole32.dll", _MaxCount=0x17 | out: _Dest="\\KnownDlls32\\Ole32.dll") returned 0x16 [0051.910] strlen (_Str="\\KnownDlls\\ntdll.dll") returned 0x14 [0051.910] mbstowcs (in: _Dest=0x508d948, _Source="\\KnownDlls\\ntdll.dll", _MaxCount=0x15 | out: _Dest="\\KnownDlls\\ntdll.dll") returned 0x14 [0051.910] strlen (_Str="\\KnownDlls\\advapi32.dll") returned 0x17 [0051.910] mbstowcs (in: _Dest=0x508dd58, _Source="\\KnownDlls\\advapi32.dll", _MaxCount=0x18 | out: _Dest="\\KnownDlls\\advapi32.dll") returned 0x17 [0051.910] strlen (_Str="\\KnownDlls\\kernel32.dll") returned 0x17 [0051.910] mbstowcs (in: _Dest=0x508d538, _Source="\\KnownDlls\\kernel32.dll", _MaxCount=0x18 | out: _Dest="\\KnownDlls\\kernel32.dll") returned 0x17 [0051.910] strlen (_Str="\\KnownDlls\\user32.dll") returned 0x15 [0051.910] mbstowcs (in: _Dest=0x508db50, _Source="\\KnownDlls\\user32.dll", _MaxCount=0x16 | out: _Dest="\\KnownDlls\\user32.dll") returned 0x15 [0051.910] strlen (_Str="\\KnownDlls\\Ole32.dll") returned 0x14 [0051.910] mbstowcs (in: _Dest=0x508d330, _Source="\\KnownDlls\\Ole32.dll", _MaxCount=0x15 | out: _Dest="\\KnownDlls\\Ole32.dll") returned 0x14 [0051.910] wcslen (_String="\\KnownDlls32\\advapi32.dll") returned 0x19 [0051.910] NtOpenSection (in: SectionHandle=0x508caec, DesiredAccess=0xc, ObjectAttributes=0x508ca9c*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\advapi32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x508caec*=0x33c) returned 0x0 [0051.910] NtMapViewOfSection (in: SectionHandle=0x33c, ProcessHandle=0xffffffff, BaseAddress=0x508caf4*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x508caf0*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x508caf4*=0x58d0000, SectionOffset=0x0, ViewSize=0x508caf0*=0xa0000) returned 0x40000003 [0051.911] wcslen (_String="\\KnownDlls32\\ntdll.dll") returned 0x16 [0051.911] NtOpenSection (in: SectionHandle=0x508caec, DesiredAccess=0xc, ObjectAttributes=0x508ca9c*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\ntdll.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x508caec*=0x334) returned 0x0 [0051.911] NtMapViewOfSection (in: SectionHandle=0x334, ProcessHandle=0xffffffff, BaseAddress=0x508caf4*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x508caf0*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x508caf4*=0x5970000, SectionOffset=0x0, ViewSize=0x508caf0*=0x180000) returned 0x40000003 [0051.911] wcslen (_String="\\KnownDlls32\\kernel32.dll") returned 0x19 [0051.911] NtOpenSection (in: SectionHandle=0x508caec, DesiredAccess=0xc, ObjectAttributes=0x508ca9c*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\kernel32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x508caec*=0x340) returned 0x0 [0051.911] NtMapViewOfSection (in: SectionHandle=0x340, ProcessHandle=0xffffffff, BaseAddress=0x508caf4*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x508caf0*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x508caf4*=0x5af0000, SectionOffset=0x0, ViewSize=0x508caf0*=0x110000) returned 0x40000003 [0051.911] wcslen (_String="\\KnownDlls32\\user32.dll") returned 0x17 [0051.911] NtOpenSection (in: SectionHandle=0x508caec, DesiredAccess=0xc, ObjectAttributes=0x508ca9c*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\user32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x508caec*=0x344) returned 0x0 [0051.911] NtMapViewOfSection (in: SectionHandle=0x344, ProcessHandle=0xffffffff, BaseAddress=0x508caf4*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x508caf0*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x508caf4*=0x5c00000, SectionOffset=0x0, ViewSize=0x508caf0*=0x100000) returned 0x40000003 [0051.911] wcslen (_String="\\KnownDlls32\\Ole32.dll") returned 0x16 [0051.911] NtOpenSection (in: SectionHandle=0x508caec, DesiredAccess=0xc, ObjectAttributes=0x508ca9c*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\Ole32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x508caec*=0x348) returned 0x0 [0051.911] NtMapViewOfSection (in: SectionHandle=0x348, ProcessHandle=0xffffffff, BaseAddress=0x508caf4*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x508caf0*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x508caf4*=0x5d00000, SectionOffset=0x0, ViewSize=0x508caf0*=0x15c000) returned 0x40000003 [0051.913] LoadLibraryA (lpLibFileName="Ole32.dll") returned 0x755e0000 [0051.913] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0051.913] GetProcAddress (hModule=0x74d40000, lpProcName="CryptAcquireContextW") returned 0x74d4df14 [0051.913] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0051.913] GetProcAddress (hModule=0x74d40000, lpProcName="CryptCreateHash") returned 0x74d4df4e [0051.913] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0051.914] GetProcAddress (hModule=0x74d40000, lpProcName="CryptDecrypt") returned 0x74d83178 [0051.914] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0051.914] GetProcAddress (hModule=0x74d40000, lpProcName="CryptDeriveKey") returned 0x74d83188 [0051.914] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0051.914] GetProcAddress (hModule=0x74d40000, lpProcName="CryptDestroyHash") returned 0x74d4df66 [0051.914] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0051.915] GetProcAddress (hModule=0x74d40000, lpProcName="CryptDestroyKey") returned 0x74d4c51a [0051.915] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0051.915] GetProcAddress (hModule=0x74d40000, lpProcName="CryptHashData") returned 0x74d4df36 [0051.915] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0051.915] GetProcAddress (hModule=0x74d40000, lpProcName="CryptReleaseContext") returned 0x74d4e124 [0051.917] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0051.917] GetProcAddress (hModule=0x74f40000, lpProcName="MessageBoxA") returned 0x74fafd1e [0051.917] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0051.917] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0051.917] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0051.917] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0051.918] GetProcAddress (hModule=0x755e0000, lpProcName="CoInitializeEx") returned 0x756209ad [0051.918] GetProcAddress (hModule=0x755e0000, lpProcName="CoCreateInstance") returned 0x75629d0b [0051.918] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0051.918] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexW") returned 0x76c3424c [0051.918] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="frenchy_shellcode_003") returned 0x34c [0051.919] strlen (_Str="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe") returned 0x38 [0051.919] strlen (_Str="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe") returned 0x38 [0051.919] mbstowcs (in: _Dest=0x508e410, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe", _MaxCount=0x39 | out: _Dest="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe") returned 0x38 [0051.919] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe", lpDst=0x508e8e8, nSize=0x104 | out: lpDst="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe") returned 0x39 [0051.919] CreateProcessW (in: lpApplicationName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x800000c, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x508e9f0*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x508ea70 | out: lpCommandLine=0x0, lpProcessInformation=0x508ea70*(hProcess=0x354, hThread=0x350, dwProcessId=0xb48, dwThreadId=0xb4c)) returned 1 [0051.923] NtQueryInformationProcess (in: ProcessHandle=0x354, ProcessInformationClass=0x0, ProcessInformation=0x508ea3c, ProcessInformationLength=0x18, ReturnLength=0x0 | out: ProcessInformation=0x508ea3c, ReturnLength=0x0) returned 0x0 [0051.923] NtReadVirtualMemory (in: ProcessHandle=0x354, BaseAddress=0x7efde008, Buffer=0x508ea90, NumberOfBytesToRead=0x4, NumberOfBytesRead=0x0 | out: Buffer=0x508ea90*, NumberOfBytesRead=0x0) returned 0x0 [0051.923] NtCreateSection (in: SectionHandle=0x508ea68, DesiredAccess=0xf001f, ObjectAttributes=0x0, MaximumSize=0x508ea58, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x508ea68*=0x35c) returned 0x0 [0051.923] NtMapViewOfSection (in: SectionHandle=0x35c, ProcessHandle=0xffffffff, BaseAddress=0x508ea84*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x508ea60*=0x3a000, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x508ea84*=0xce0000, SectionOffset=0x0, ViewSize=0x508ea60*=0x3a000) returned 0x0 [0051.923] NtMapViewOfSection (in: SectionHandle=0x35c, ProcessHandle=0x354, BaseAddress=0x508ea80*=0x400000, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x508ea64*=0x3a000, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x508ea80*=0x400000, SectionOffset=0x0, ViewSize=0x508ea64*=0x3a000) returned 0x0 [0051.926] NtWriteVirtualMemory (in: ProcessHandle=0x354, BaseAddress=0x7efde008, Buffer=0x508ea80*, NumberOfBytesToWrite=0x4, NumberOfBytesWritten=0x508ea54 | out: Buffer=0x508ea80*, NumberOfBytesWritten=0x508ea54*=0x4) returned 0x0 [0051.926] NtGetContextThread (in: ThreadHandle=0x350, Context=0x508e618 | out: Context=0x508e618*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0xd7ccba, Ebp=0x0, Eip=0x771401c4, SegCs=0x23, EFlags=0x202, Esp=0x2efafc, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0051.942] NtSetContextThread (ThreadHandle=0x350, Context=0x508e618*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x4352ee, Ebp=0x0, Eip=0x771401c4, SegCs=0x23, EFlags=0x202, Esp=0x2efafc, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0051.942] NtResumeThread (in: ThreadHandle=0x350, SuspendCount=0x0 | out: SuspendCount=0x0) returned 0x0 [0051.945] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe", nBufferLength=0x105, lpBuffer=0x508ebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe", lpFilePart=0x0) returned 0x2b [0051.953] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x35a180 [0051.953] LocalAlloc (uFlags=0x0, uBytes=0xa0) returned 0x323518 [0057.201] LocalFree (hMem=0x35a180) returned 0x0 [0057.201] LocalFree (hMem=0x323518) returned 0x0 [0057.224] GetCurrentProcess () returned 0xffffffff [0057.235] GetKernelObjectSecurity (in: Handle=0xffffffff, RequestedInformation=0x4, pSecurityDescriptor=0x2a34e58, nLength=0x0, lpnLengthNeeded=0x508f130 | out: pSecurityDescriptor=0x2a34e58, lpnLengthNeeded=0x508f130) returned 0 [0057.235] GetKernelObjectSecurity (in: Handle=0xffffffff, RequestedInformation=0x4, pSecurityDescriptor=0x2a34eb4, nLength=0x64, lpnLengthNeeded=0x508f130 | out: pSecurityDescriptor=0x2a34eb4, lpnLengthNeeded=0x508f130) returned 1 [0057.299] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x508e97c | out: lpLuid=0x508e97c*(LowPart=0x14, HighPart=0)) returned 1 [0057.300] GetCurrentProcess () returned 0xffffffff [0057.300] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x508e978 | out: TokenHandle=0x508e978*=0x370) returned 1 [0057.300] AdjustTokenPrivileges (in: TokenHandle=0x370, DisableAllPrivileges=0, NewState=0x2a35168*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0057.300] CloseHandle (hObject=0x370) returned 1 [0057.321] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f05c | out: SystemInformation=0x39d4310, ResultLength=0x508f05c*=0xa030) returned 0x0 [0057.333] GetCurrentProcessId () returned 0xa20 [0057.335] GetCurrentProcessId () returned 0xa20 [0057.336] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.338] GetCurrentProcessId () returned 0xa20 [0057.338] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.339] GetCurrentProcessId () returned 0xa20 [0057.339] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.339] GetCurrentProcessId () returned 0xa20 [0057.339] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.340] GetCurrentProcessId () returned 0xa20 [0057.340] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.343] GetCurrentProcessId () returned 0xa20 [0057.343] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.344] GetCurrentProcessId () returned 0xa20 [0057.344] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.344] GetCurrentProcessId () returned 0xa20 [0057.344] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.345] GetCurrentProcessId () returned 0xa20 [0057.345] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.346] GetCurrentProcessId () returned 0xa20 [0057.346] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.346] GetCurrentProcessId () returned 0xa20 [0057.346] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.347] GetCurrentProcessId () returned 0xa20 [0057.347] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.347] GetCurrentProcessId () returned 0xa20 [0057.347] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.348] GetCurrentProcessId () returned 0xa20 [0057.348] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.348] GetCurrentProcessId () returned 0xa20 [0057.348] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.349] GetCurrentProcessId () returned 0xa20 [0057.349] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.349] GetCurrentProcessId () returned 0xa20 [0057.349] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.353] GetCurrentProcessId () returned 0xa20 [0057.353] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.354] GetCurrentProcessId () returned 0xa20 [0057.354] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.354] GetCurrentProcessId () returned 0xa20 [0057.354] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.355] GetCurrentProcessId () returned 0xa20 [0057.355] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.355] GetCurrentProcessId () returned 0xa20 [0057.356] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.356] GetCurrentProcessId () returned 0xa20 [0057.356] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.357] GetCurrentProcessId () returned 0xa20 [0057.357] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.357] GetCurrentProcessId () returned 0xa20 [0057.357] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.357] GetCurrentProcessId () returned 0xa20 [0057.357] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.358] GetCurrentProcessId () returned 0xa20 [0057.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.358] GetCurrentProcessId () returned 0xa20 [0057.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.358] GetCurrentProcessId () returned 0xa20 [0057.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.359] GetCurrentProcessId () returned 0xa20 [0057.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.359] GetCurrentProcessId () returned 0xa20 [0057.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.364] GetCurrentProcessId () returned 0xa20 [0057.364] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.364] GetCurrentProcessId () returned 0xa20 [0057.364] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.364] GetCurrentProcessId () returned 0xa20 [0057.364] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.365] GetCurrentProcessId () returned 0xa20 [0057.365] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.365] GetCurrentProcessId () returned 0xa20 [0057.365] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.365] GetCurrentProcessId () returned 0xa20 [0057.365] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.365] GetCurrentProcessId () returned 0xa20 [0057.365] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.366] GetCurrentProcessId () returned 0xa20 [0057.366] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.366] GetCurrentProcessId () returned 0xa20 [0057.366] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.366] GetCurrentProcessId () returned 0xa20 [0057.366] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.367] GetCurrentProcessId () returned 0xa20 [0057.367] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.367] GetCurrentProcessId () returned 0xa20 [0057.367] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.367] GetCurrentProcessId () returned 0xa20 [0057.367] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.371] GetCurrentProcessId () returned 0xa20 [0057.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.382] OpenThread (dwDesiredAccess=0x1f03ff, bInheritHandle=0, dwThreadId=0xa24) returned 0x368 [0057.382] GetKernelObjectSecurity (in: Handle=0x368, RequestedInformation=0x4, pSecurityDescriptor=0x29dad54, nLength=0x0, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x29dad54, lpnLengthNeeded=0x508f0a4) returned 0 [0057.383] GetKernelObjectSecurity (in: Handle=0x368, RequestedInformation=0x4, pSecurityDescriptor=0x29dadb0, nLength=0x64, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x29dadb0, lpnLengthNeeded=0x508f0a4) returned 1 [0057.396] SetKernelObjectSecurity (Handle=0x368, SecurityInformation=0x4, SecurityDescriptor=0x29db058) returned 1 [0057.396] GetCurrentProcessId () returned 0xa20 [0057.396] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.415] OpenThread (dwDesiredAccess=0x1f03ff, bInheritHandle=0, dwThreadId=0xa28) returned 0x364 [0057.415] GetKernelObjectSecurity (in: Handle=0x364, RequestedInformation=0x4, pSecurityDescriptor=0x29eeb44, nLength=0x0, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x29eeb44, lpnLengthNeeded=0x508f0a4) returned 0 [0057.416] GetKernelObjectSecurity (in: Handle=0x364, RequestedInformation=0x4, pSecurityDescriptor=0x29eeba0, nLength=0x64, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x29eeba0, lpnLengthNeeded=0x508f0a4) returned 1 [0057.416] SetKernelObjectSecurity (Handle=0x364, SecurityInformation=0x4, SecurityDescriptor=0x29eee48) returned 1 [0057.416] GetCurrentProcessId () returned 0xa20 [0057.416] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.416] OpenThread (dwDesiredAccess=0x1f03ff, bInheritHandle=0, dwThreadId=0xa2c) returned 0x360 [0057.416] GetKernelObjectSecurity (in: Handle=0x360, RequestedInformation=0x4, pSecurityDescriptor=0x2a02934, nLength=0x0, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x2a02934, lpnLengthNeeded=0x508f0a4) returned 0 [0057.417] GetKernelObjectSecurity (in: Handle=0x360, RequestedInformation=0x4, pSecurityDescriptor=0x2a02990, nLength=0x64, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x2a02990, lpnLengthNeeded=0x508f0a4) returned 1 [0057.417] SetKernelObjectSecurity (Handle=0x360, SecurityInformation=0x4, SecurityDescriptor=0x2a02c38) returned 1 [0057.417] GetCurrentProcessId () returned 0xa20 [0057.417] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.417] OpenThread (dwDesiredAccess=0x1f03ff, bInheritHandle=0, dwThreadId=0xa30) returned 0x358 [0057.417] GetKernelObjectSecurity (in: Handle=0x358, RequestedInformation=0x4, pSecurityDescriptor=0x2a16724, nLength=0x0, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x2a16724, lpnLengthNeeded=0x508f0a4) returned 0 [0057.417] GetKernelObjectSecurity (in: Handle=0x358, RequestedInformation=0x4, pSecurityDescriptor=0x2a16780, nLength=0x64, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x2a16780, lpnLengthNeeded=0x508f0a4) returned 1 [0057.418] SetKernelObjectSecurity (Handle=0x358, SecurityInformation=0x4, SecurityDescriptor=0x2a16a28) returned 1 [0057.418] GetCurrentProcessId () returned 0xa20 [0057.418] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.418] OpenThread (dwDesiredAccess=0x1f03ff, bInheritHandle=0, dwThreadId=0xa44) returned 0x36c [0057.418] GetKernelObjectSecurity (in: Handle=0x36c, RequestedInformation=0x4, pSecurityDescriptor=0x2a2a514, nLength=0x0, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x2a2a514, lpnLengthNeeded=0x508f0a4) returned 0 [0057.418] GetKernelObjectSecurity (in: Handle=0x36c, RequestedInformation=0x4, pSecurityDescriptor=0x2a2a570, nLength=0x64, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x2a2a570, lpnLengthNeeded=0x508f0a4) returned 1 [0057.418] SetKernelObjectSecurity (Handle=0x36c, SecurityInformation=0x4, SecurityDescriptor=0x2a2a818) returned 1 [0057.418] GetCurrentProcessId () returned 0xa20 [0057.419] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.419] OpenThread (dwDesiredAccess=0x1f03ff, bInheritHandle=0, dwThreadId=0xa48) returned 0x4b0 [0057.419] GetKernelObjectSecurity (in: Handle=0x4b0, RequestedInformation=0x4, pSecurityDescriptor=0x2a3e304, nLength=0x0, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x2a3e304, lpnLengthNeeded=0x508f0a4) returned 0 [0057.419] GetKernelObjectSecurity (in: Handle=0x4b0, RequestedInformation=0x4, pSecurityDescriptor=0x2a3e360, nLength=0x64, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x2a3e360, lpnLengthNeeded=0x508f0a4) returned 1 [0057.419] SetKernelObjectSecurity (Handle=0x4b0, SecurityInformation=0x4, SecurityDescriptor=0x2a3e608) returned 1 [0057.419] GetCurrentProcessId () returned 0xa20 [0057.419] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.420] OpenThread (dwDesiredAccess=0x1f03ff, bInheritHandle=0, dwThreadId=0xa4c) returned 0x370 [0057.420] GetKernelObjectSecurity (in: Handle=0x370, RequestedInformation=0x4, pSecurityDescriptor=0x2a520f4, nLength=0x0, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x2a520f4, lpnLengthNeeded=0x508f0a4) returned 0 [0057.420] GetKernelObjectSecurity (in: Handle=0x370, RequestedInformation=0x4, pSecurityDescriptor=0x2a52150, nLength=0x64, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x2a52150, lpnLengthNeeded=0x508f0a4) returned 1 [0057.420] SetKernelObjectSecurity (Handle=0x370, SecurityInformation=0x4, SecurityDescriptor=0x2a523f8) returned 1 [0057.420] GetCurrentProcessId () returned 0xa20 [0057.420] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.420] OpenThread (dwDesiredAccess=0x1f03ff, bInheritHandle=0, dwThreadId=0xa50) returned 0x484 [0057.420] GetKernelObjectSecurity (in: Handle=0x484, RequestedInformation=0x4, pSecurityDescriptor=0x2a65ee4, nLength=0x0, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x2a65ee4, lpnLengthNeeded=0x508f0a4) returned 0 [0057.421] GetKernelObjectSecurity (in: Handle=0x484, RequestedInformation=0x4, pSecurityDescriptor=0x2a65f40, nLength=0x64, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x2a65f40, lpnLengthNeeded=0x508f0a4) returned 1 [0057.421] SetKernelObjectSecurity (Handle=0x484, SecurityInformation=0x4, SecurityDescriptor=0x2a661e8) returned 1 [0057.421] GetCurrentProcessId () returned 0xa20 [0057.421] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.421] OpenThread (dwDesiredAccess=0x1f03ff, bInheritHandle=0, dwThreadId=0xacc) returned 0x480 [0057.421] GetKernelObjectSecurity (in: Handle=0x480, RequestedInformation=0x4, pSecurityDescriptor=0x2a79cd4, nLength=0x0, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x2a79cd4, lpnLengthNeeded=0x508f0a4) returned 0 [0057.421] GetKernelObjectSecurity (in: Handle=0x480, RequestedInformation=0x4, pSecurityDescriptor=0x2a79d30, nLength=0x64, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x2a79d30, lpnLengthNeeded=0x508f0a4) returned 1 [0057.422] SetKernelObjectSecurity (Handle=0x480, SecurityInformation=0x4, SecurityDescriptor=0x2a79fd8) returned 1 [0057.422] GetCurrentProcessId () returned 0xa20 [0057.422] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.422] OpenThread (dwDesiredAccess=0x1f03ff, bInheritHandle=0, dwThreadId=0xad0) returned 0x464 [0057.422] GetKernelObjectSecurity (in: Handle=0x464, RequestedInformation=0x4, pSecurityDescriptor=0x2a8dac4, nLength=0x0, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x2a8dac4, lpnLengthNeeded=0x508f0a4) returned 0 [0057.422] GetKernelObjectSecurity (in: Handle=0x464, RequestedInformation=0x4, pSecurityDescriptor=0x2a8db20, nLength=0x64, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x2a8db20, lpnLengthNeeded=0x508f0a4) returned 1 [0057.422] SetKernelObjectSecurity (Handle=0x464, SecurityInformation=0x4, SecurityDescriptor=0x2a8ddc8) returned 1 [0057.422] GetCurrentProcessId () returned 0xa20 [0057.422] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.423] OpenThread (dwDesiredAccess=0x1f03ff, bInheritHandle=0, dwThreadId=0xad4) returned 0x460 [0057.423] GetKernelObjectSecurity (in: Handle=0x460, RequestedInformation=0x4, pSecurityDescriptor=0x2aa18b4, nLength=0x0, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x2aa18b4, lpnLengthNeeded=0x508f0a4) returned 0 [0057.423] GetKernelObjectSecurity (in: Handle=0x460, RequestedInformation=0x4, pSecurityDescriptor=0x2aa1910, nLength=0x64, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x2aa1910, lpnLengthNeeded=0x508f0a4) returned 1 [0057.423] SetKernelObjectSecurity (Handle=0x460, SecurityInformation=0x4, SecurityDescriptor=0x2aa1bb8) returned 1 [0057.423] GetCurrentProcessId () returned 0xa20 [0057.423] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.424] OpenThread (dwDesiredAccess=0x1f03ff, bInheritHandle=0, dwThreadId=0xad8) returned 0x458 [0057.424] GetKernelObjectSecurity (in: Handle=0x458, RequestedInformation=0x4, pSecurityDescriptor=0x2ab56a4, nLength=0x0, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x2ab56a4, lpnLengthNeeded=0x508f0a4) returned 0 [0057.424] GetKernelObjectSecurity (in: Handle=0x458, RequestedInformation=0x4, pSecurityDescriptor=0x2ab5700, nLength=0x64, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x2ab5700, lpnLengthNeeded=0x508f0a4) returned 1 [0057.424] SetKernelObjectSecurity (Handle=0x458, SecurityInformation=0x4, SecurityDescriptor=0x2ab59a8) returned 1 [0057.424] GetCurrentProcessId () returned 0xa20 [0057.424] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.428] OpenThread (dwDesiredAccess=0x1f03ff, bInheritHandle=0, dwThreadId=0xb60) returned 0x468 [0057.428] GetKernelObjectSecurity (in: Handle=0x468, RequestedInformation=0x4, pSecurityDescriptor=0x28d6358, nLength=0x0, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x28d6358, lpnLengthNeeded=0x508f0a4) returned 0 [0057.428] GetKernelObjectSecurity (in: Handle=0x468, RequestedInformation=0x4, pSecurityDescriptor=0x28d63b4, nLength=0x64, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x28d63b4, lpnLengthNeeded=0x508f0a4) returned 1 [0057.428] SetKernelObjectSecurity (Handle=0x468, SecurityInformation=0x4, SecurityDescriptor=0x28d665c) returned 1 [0057.428] GetCurrentProcessId () returned 0xa20 [0057.428] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.428] OpenThread (dwDesiredAccess=0x1f03ff, bInheritHandle=0, dwThreadId=0xb64) returned 0x450 [0057.429] GetKernelObjectSecurity (in: Handle=0x450, RequestedInformation=0x4, pSecurityDescriptor=0x28ea148, nLength=0x0, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x28ea148, lpnLengthNeeded=0x508f0a4) returned 0 [0057.429] GetKernelObjectSecurity (in: Handle=0x450, RequestedInformation=0x4, pSecurityDescriptor=0x28ea1a4, nLength=0x64, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x28ea1a4, lpnLengthNeeded=0x508f0a4) returned 1 [0057.429] SetKernelObjectSecurity (Handle=0x450, SecurityInformation=0x4, SecurityDescriptor=0x28ea44c) returned 1 [0057.429] GetCurrentProcessId () returned 0xa20 [0057.429] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.429] OpenThread (dwDesiredAccess=0x1f03ff, bInheritHandle=0, dwThreadId=0xb68) returned 0x4a8 [0057.429] GetKernelObjectSecurity (in: Handle=0x4a8, RequestedInformation=0x4, pSecurityDescriptor=0x28fdf38, nLength=0x0, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x28fdf38, lpnLengthNeeded=0x508f0a4) returned 0 [0057.429] GetKernelObjectSecurity (in: Handle=0x4a8, RequestedInformation=0x4, pSecurityDescriptor=0x28fdf94, nLength=0x64, lpnLengthNeeded=0x508f0a4 | out: pSecurityDescriptor=0x28fdf94, lpnLengthNeeded=0x508f0a4) returned 1 [0057.430] SetKernelObjectSecurity (Handle=0x4a8, SecurityInformation=0x4, SecurityDescriptor=0x28fe23c) returned 1 [0057.430] GetCurrentProcessId () returned 0xa20 [0057.430] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.430] GetCurrentProcessId () returned 0xa20 [0057.430] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.430] GetCurrentProcessId () returned 0xa20 [0057.430] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.431] GetCurrentProcessId () returned 0xa20 [0057.431] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.431] GetCurrentProcessId () returned 0xa20 [0057.431] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.431] GetCurrentProcessId () returned 0xa20 [0057.431] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.431] GetCurrentProcessId () returned 0xa20 [0057.432] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.432] GetCurrentProcessId () returned 0xa20 [0057.432] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f04c | out: SystemInformation=0x39d4310, ResultLength=0x508f04c*=0xa030) returned 0x0 [0057.432] SetKernelObjectSecurity (Handle=0xffffffff, SecurityInformation=0x4, SecurityDescriptor=0x299b658) returned 1 [0057.492] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa030) returned 0x0 [0057.496] GetCurrentProcessId () returned 0xa20 [0057.496] GetCurrentProcessId () returned 0xa20 [0057.496] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.497] GetCurrentProcessId () returned 0xa20 [0057.497] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.497] GetCurrentProcessId () returned 0xa20 [0057.497] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.497] GetCurrentProcessId () returned 0xa20 [0057.497] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.498] GetCurrentProcessId () returned 0xa20 [0057.498] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.498] GetCurrentProcessId () returned 0xa20 [0057.498] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.498] GetCurrentProcessId () returned 0xa20 [0057.498] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.499] GetCurrentProcessId () returned 0xa20 [0057.499] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.499] GetCurrentProcessId () returned 0xa20 [0057.499] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.499] GetCurrentProcessId () returned 0xa20 [0057.499] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.499] GetCurrentProcessId () returned 0xa20 [0057.499] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.500] GetCurrentProcessId () returned 0xa20 [0057.500] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.500] GetCurrentProcessId () returned 0xa20 [0057.500] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.500] GetCurrentProcessId () returned 0xa20 [0057.500] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.501] GetCurrentProcessId () returned 0xa20 [0057.501] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.503] GetCurrentProcessId () returned 0xa20 [0057.503] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.504] GetCurrentProcessId () returned 0xa20 [0057.504] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.504] GetCurrentProcessId () returned 0xa20 [0057.504] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.504] GetCurrentProcessId () returned 0xa20 [0057.504] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.505] GetCurrentProcessId () returned 0xa20 [0057.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.505] GetCurrentProcessId () returned 0xa20 [0057.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.505] GetCurrentProcessId () returned 0xa20 [0057.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.506] GetCurrentProcessId () returned 0xa20 [0057.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.506] GetCurrentProcessId () returned 0xa20 [0057.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.506] GetCurrentProcessId () returned 0xa20 [0057.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.511] GetCurrentProcessId () returned 0xa20 [0057.511] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.511] GetCurrentProcessId () returned 0xa20 [0057.511] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.511] GetCurrentProcessId () returned 0xa20 [0057.511] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.512] GetCurrentProcessId () returned 0xa20 [0057.512] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.512] GetCurrentProcessId () returned 0xa20 [0057.512] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.512] GetCurrentProcessId () returned 0xa20 [0057.512] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.513] GetCurrentProcessId () returned 0xa20 [0057.513] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.513] GetCurrentProcessId () returned 0xa20 [0057.513] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.513] GetCurrentProcessId () returned 0xa20 [0057.513] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.513] GetCurrentProcessId () returned 0xa20 [0057.513] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.514] GetCurrentProcessId () returned 0xa20 [0057.514] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.514] GetCurrentProcessId () returned 0xa20 [0057.514] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.514] GetCurrentProcessId () returned 0xa20 [0057.514] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.515] GetCurrentProcessId () returned 0xa20 [0057.515] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.515] GetCurrentProcessId () returned 0xa20 [0057.515] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.515] GetCurrentProcessId () returned 0xa20 [0057.515] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.518] GetCurrentProcessId () returned 0xa20 [0057.518] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.519] GetCurrentProcessId () returned 0xa20 [0057.519] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.519] GetCurrentProcessId () returned 0xa20 [0057.519] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.519] GetCurrentProcessId () returned 0xa20 [0057.519] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.519] GetCurrentProcessId () returned 0xa20 [0057.519] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.520] GetCurrentProcessId () returned 0xa20 [0057.520] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.520] GetCurrentProcessId () returned 0xa20 [0057.520] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.520] GetCurrentProcessId () returned 0xa20 [0057.520] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.521] GetCurrentProcessId () returned 0xa20 [0057.521] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.521] GetCurrentProcessId () returned 0xa20 [0057.521] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.521] GetCurrentProcessId () returned 0xa20 [0057.521] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f098 | out: SystemInformation=0x39d4310, ResultLength=0x508f098*=0xa030) returned 0x0 [0057.528] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0b0 | out: SystemInformation=0x39d4310, ResultLength=0x508f0b0*=0xa030) returned 0x0 [0057.528] GetCurrentProcessId () returned 0xa20 [0057.528] GetCurrentProcessId () returned 0xa20 [0057.528] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa030) returned 0x0 [0057.528] GetCurrentProcessId () returned 0xa20 [0057.528] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa030) returned 0x0 [0057.529] GetCurrentProcessId () returned 0xa20 [0057.529] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa030) returned 0x0 [0057.529] GetCurrentProcessId () returned 0xa20 [0057.529] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa030) returned 0x0 [0057.529] GetCurrentProcessId () returned 0xa20 [0057.529] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa030) returned 0x0 [0057.529] GetCurrentProcessId () returned 0xa20 [0057.529] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa030) returned 0x0 [0057.530] GetCurrentProcessId () returned 0xa20 [0057.530] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa030) returned 0x0 [0057.530] GetCurrentProcessId () returned 0xa20 [0057.530] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa030) returned 0x0 [0057.530] GetCurrentProcessId () returned 0xa20 [0057.530] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa030) returned 0x0 [0057.531] GetCurrentProcessId () returned 0xa20 [0057.531] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa030) returned 0x0 [0057.531] GetCurrentProcessId () returned 0xa20 [0057.531] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa030) returned 0x0 [0057.531] GetCurrentProcessId () returned 0xa20 [0057.531] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa030) returned 0x0 [0057.531] GetCurrentProcessId () returned 0xa20 [0057.531] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa030) returned 0x0 [0057.532] GetCurrentProcessId () returned 0xa20 [0057.532] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa030) returned 0x0 [0057.550] GetCurrentProcessId () returned 0xa20 [0057.550] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.550] GetCurrentProcessId () returned 0xa20 [0057.550] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.551] GetCurrentProcessId () returned 0xa20 [0057.551] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.551] GetCurrentProcessId () returned 0xa20 [0057.551] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.551] GetCurrentProcessId () returned 0xa20 [0057.551] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.552] GetCurrentProcessId () returned 0xa20 [0057.552] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.552] GetCurrentProcessId () returned 0xa20 [0057.552] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.552] GetCurrentProcessId () returned 0xa20 [0057.552] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.552] GetCurrentProcessId () returned 0xa20 [0057.552] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.569] GetCurrentProcessId () returned 0xa20 [0057.569] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.569] GetCurrentProcessId () returned 0xa20 [0057.569] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.570] GetCurrentProcessId () returned 0xa20 [0057.570] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.570] GetCurrentProcessId () returned 0xa20 [0057.570] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.570] GetCurrentProcessId () returned 0xa20 [0057.570] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.571] GetCurrentProcessId () returned 0xa20 [0057.571] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.571] GetCurrentProcessId () returned 0xa20 [0057.571] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.571] GetCurrentProcessId () returned 0xa20 [0057.571] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.571] GetCurrentProcessId () returned 0xa20 [0057.571] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.572] GetCurrentProcessId () returned 0xa20 [0057.572] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.572] GetCurrentProcessId () returned 0xa20 [0057.572] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.572] GetCurrentProcessId () returned 0xa20 [0057.572] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.573] GetCurrentProcessId () returned 0xa20 [0057.573] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.573] GetCurrentProcessId () returned 0xa20 [0057.573] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.573] GetCurrentProcessId () returned 0xa20 [0057.573] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.573] GetCurrentProcessId () returned 0xa20 [0057.573] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.574] GetCurrentProcessId () returned 0xa20 [0057.574] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.577] GetCurrentProcessId () returned 0xa20 [0057.577] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.577] GetCurrentProcessId () returned 0xa20 [0057.577] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.578] GetCurrentProcessId () returned 0xa20 [0057.578] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.578] GetCurrentProcessId () returned 0xa20 [0057.578] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.578] GetCurrentProcessId () returned 0xa20 [0057.578] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.578] GetCurrentProcessId () returned 0xa20 [0057.579] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.579] GetCurrentProcessId () returned 0xa20 [0057.579] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.579] GetCurrentProcessId () returned 0xa20 [0057.579] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.579] GetCurrentProcessId () returned 0xa20 [0057.579] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.580] GetCurrentProcessId () returned 0xa20 [0057.580] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.580] GetCurrentProcessId () returned 0xa20 [0057.580] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.580] GetCurrentProcessId () returned 0xa20 [0057.580] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0a4 | out: SystemInformation=0x39d4310, ResultLength=0x508f0a4*=0xa070) returned 0x0 [0057.580] GetCurrentProcessId () returned 0xa20 [0057.582] GetCurrentProcessId () returned 0xa20 [0057.590] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0e0 | out: SystemInformation=0x39d4310, ResultLength=0x508f0e0*=0xa070) returned 0x0 [0057.596] SleepEx (dwMilliseconds=0x258, bAlertable=1) returned 0x0 [0058.272] GetCurrentProcessId () returned 0xa20 [0058.272] GetCurrentProcessId () returned 0xa20 [0058.272] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0e0 | out: SystemInformation=0x39d4310, ResultLength=0x508f0e0*=0xa400) returned 0x0 [0058.276] SleepEx (dwMilliseconds=0x258, bAlertable=1) returned 0x0 [0059.006] GetCurrentProcessId () returned 0xa20 [0059.006] GetCurrentProcessId () returned 0xa20 [0059.006] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0e0 | out: SystemInformation=0x39d4310, ResultLength=0x508f0e0*=0xa668) returned 0x0 [0059.008] SleepEx (dwMilliseconds=0x258, bAlertable=1) returned 0x0 [0059.784] GetCurrentProcessId () returned 0xa20 [0059.784] GetCurrentProcessId () returned 0xa20 [0059.784] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0e0 | out: SystemInformation=0x39d4310, ResultLength=0x508f0e0*=0xa598) returned 0x0 [0059.785] SleepEx (dwMilliseconds=0x258, bAlertable=1) returned 0x0 [0060.604] GetCurrentProcessId () returned 0xa20 [0060.604] GetCurrentProcessId () returned 0xa20 [0060.604] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0e0 | out: SystemInformation=0x39d4310, ResultLength=0x508f0e0*=0xa6e0) returned 0x0 [0060.605] SleepEx (dwMilliseconds=0x258, bAlertable=1) returned 0x0 [0061.203] GetCurrentProcessId () returned 0xa20 [0061.203] GetCurrentProcessId () returned 0xa20 [0061.203] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0e0 | out: SystemInformation=0x39d4310, ResultLength=0x508f0e0*=0xaa48) returned 0x0 [0061.205] SleepEx (dwMilliseconds=0x258, bAlertable=1) returned 0x0 [0061.817] GetCurrentProcessId () returned 0xa20 [0061.817] GetCurrentProcessId () returned 0xa20 [0061.817] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0e0 | out: SystemInformation=0x39d4310, ResultLength=0x508f0e0*=0xa6e0) returned 0x0 [0061.856] SleepEx (dwMilliseconds=0x258, bAlertable=1) returned 0x0 [0062.462] GetCurrentProcessId () returned 0xa20 [0062.466] GetCurrentProcessId () returned 0xa20 [0062.466] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0e0 | out: SystemInformation=0x39d4310, ResultLength=0x508f0e0*=0xa760) returned 0x0 [0062.498] SleepEx (dwMilliseconds=0x258, bAlertable=1) returned 0x0 [0063.112] GetCurrentProcessId () returned 0xa20 [0063.112] GetCurrentProcessId () returned 0xa20 [0063.112] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39d4310, Length=0x20000, ResultLength=0x508f0e0 | out: SystemInformation=0x39d4310, ResultLength=0x508f0e0*=0xa760) returned 0x0 Thread: id = 8 os_tid = 0xa50 Thread: id = 9 os_tid = 0xacc [0063.914] CoGetContextToken (in: pToken=0x4f5f56c | out: pToken=0x4f5f56c) returned 0x0 [0063.914] IUnknown:QueryInterface (in: This=0x2fe880, riid=0x7404d8c4*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f5f590 | out: ppvObject=0x4f5f590*=0x2fe88c) returned 0x0 [0063.914] IComThreadingInfo:GetCurrentThreadType (in: This=0x2fe88c, pThreadType=0x4f5f5bc | out: pThreadType=0x4f5f5bc*=0) returned 0x0 [0063.915] IUnknown:Release (This=0x2fe88c) returned 0x0 Thread: id = 10 os_tid = 0xad0 Thread: id = 11 os_tid = 0xad4 Thread: id = 12 os_tid = 0xad8 Thread: id = 13 os_tid = 0xadc Thread: id = 85 os_tid = 0xb50 [0052.001] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0052.387] ShellExecuteExW (in: pExecInfo=0x2a34c28*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="cmd.exe", lpParameters="/C choice /C Y /N /D Y /T 3 & Del \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe\"", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2a34c28*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="cmd.exe", lpParameters="/C choice /C Y /N /D Y /T 3 & Del \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe\"", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x4b0)) returned 1 [0056.995] CoGetContextToken (in: pToken=0x60cf8a0 | out: pToken=0x60cf8a0) returned 0x0 [0056.995] CoUninitialize () Thread: id = 89 os_tid = 0xb60 [0055.209] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0055.210] CoGetContextToken (in: pToken=0x676f8a4 | out: pToken=0x676f8a4) returned 0x0 [0055.210] IUnknown:QueryInterface (in: This=0x2fe880, riid=0x7404d8c4*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x676f8c8 | out: ppvObject=0x676f8c8*=0x2fe88c) returned 0x0 [0055.210] IComThreadingInfo:GetCurrentThreadType (in: This=0x2fe88c, pThreadType=0x676f8f4 | out: pThreadType=0x676f8f4*=0) returned 0x0 [0055.210] IUnknown:Release (This=0x2fe88c) returned 0x0 [0055.210] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0055.210] CoUninitialize () [0055.726] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0056.137] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0056.444] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0056.482] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0056.523] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0056.736] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0056.815] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0056.864] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0056.882] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0056.916] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0056.919] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0056.945] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0056.985] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0056.987] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0057.006] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0057.241] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0057.303] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0057.350] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0057.397] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0057.459] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0057.535] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0057.596] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0057.641] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0057.675] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0057.683] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0057.685] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0057.701] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0057.733] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0057.734] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0057.741] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0057.744] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0057.838] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0057.876] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0057.889] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0057.901] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0057.902] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0057.903] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0057.927] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0057.939] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0059.960] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0059.975] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0060.003] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0060.050] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0060.090] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0060.091] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0060.091] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0060.099] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0060.323] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0060.376] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0060.408] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.257] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.289] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.290] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.291] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.307] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.308] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.324] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.330] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.340] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.340] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.347] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.347] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.352] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.352] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.352] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.359] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.359] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.363] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.368] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.369] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.373] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.400] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.412] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.414] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.415] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 Thread: id = 90 os_tid = 0xb64 Thread: id = 91 os_tid = 0xb68 Thread: id = 123 os_tid = 0x908 [0072.288] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0072.288] CoGetContextToken (in: pToken=0x6ecf4f4 | out: pToken=0x6ecf4f4) returned 0x0 [0072.288] IUnknown:QueryInterface (in: This=0x2fe880, riid=0x7404d8c4*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x6ecf518 | out: ppvObject=0x6ecf518*=0x2fe88c) returned 0x0 [0072.288] IComThreadingInfo:GetCurrentThreadType (in: This=0x2fe88c, pThreadType=0x6ecf544 | out: pThreadType=0x6ecf544*=0) returned 0x0 [0072.288] IUnknown:Release (This=0x2fe88c) returned 0x0 [0072.288] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0072.288] CoUninitialize () [0072.288] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.290] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.291] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.303] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.308] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.324] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.330] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.331] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.340] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.341] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.347] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.347] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.352] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.352] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.359] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.359] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.359] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.368] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.369] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.373] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.377] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.412] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.414] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.415] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.415] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.415] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.420] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.420] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.420] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.422] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.447] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.448] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.467] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.513] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.525] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.525] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.526] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.547] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.548] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.552] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.555] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.558] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.559] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.564] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.565] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.573] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.574] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.578] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0072.583] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 Thread: id = 124 os_tid = 0x904 Process: id = "2" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x230f4000" os_pid = "0x36c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0xa20" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cedf" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 14 os_tid = 0x2b4 Thread: id = 15 os_tid = 0x330 Thread: id = 16 os_tid = 0x7f8 Thread: id = 17 os_tid = 0x430 Thread: id = 18 os_tid = 0x268 Thread: id = 19 os_tid = 0x768 Thread: id = 20 os_tid = 0x764 Thread: id = 21 os_tid = 0x760 Thread: id = 22 os_tid = 0x75c Thread: id = 23 os_tid = 0x70c Thread: id = 24 os_tid = 0x6e8 Thread: id = 25 os_tid = 0x6d8 Thread: id = 26 os_tid = 0x6d4 Thread: id = 27 os_tid = 0x6c8 Thread: id = 28 os_tid = 0x6c0 Thread: id = 29 os_tid = 0x6b8 Thread: id = 30 os_tid = 0x6a4 Thread: id = 31 os_tid = 0x6a0 Thread: id = 32 os_tid = 0x690 Thread: id = 33 os_tid = 0x67c Thread: id = 34 os_tid = 0x490 Thread: id = 35 os_tid = 0x454 Thread: id = 36 os_tid = 0x450 Thread: id = 37 os_tid = 0x428 Thread: id = 38 os_tid = 0x424 Thread: id = 39 os_tid = 0x420 Thread: id = 40 os_tid = 0x404 Thread: id = 41 os_tid = 0x18c Thread: id = 42 os_tid = 0xf0 Thread: id = 43 os_tid = 0xc8 Thread: id = 44 os_tid = 0x3f0 Thread: id = 45 os_tid = 0x3e4 Thread: id = 46 os_tid = 0x398 Thread: id = 47 os_tid = 0x394 Thread: id = 48 os_tid = 0x390 Thread: id = 49 os_tid = 0x38c Thread: id = 50 os_tid = 0x378 Thread: id = 51 os_tid = 0x370 Thread: id = 60 os_tid = 0xae0 Thread: id = 61 os_tid = 0xae4 Thread: id = 62 os_tid = 0xae8 Thread: id = 63 os_tid = 0xaec Thread: id = 94 os_tid = 0xb8c Thread: id = 95 os_tid = 0xb90 Thread: id = 96 os_tid = 0xb94 Thread: id = 97 os_tid = 0xb98 Thread: id = 98 os_tid = 0xb9c Thread: id = 99 os_tid = 0xba0 Thread: id = 100 os_tid = 0xba4 Thread: id = 101 os_tid = 0xba8 Thread: id = 102 os_tid = 0xbac Thread: id = 103 os_tid = 0xbb0 Thread: id = 104 os_tid = 0xbb4 Thread: id = 107 os_tid = 0xbc0 Thread: id = 108 os_tid = 0xbc4 Thread: id = 128 os_tid = 0x7c8 Thread: id = 129 os_tid = 0x5b8 Thread: id = 130 os_tid = 0x7c4 Thread: id = 131 os_tid = 0x950 Thread: id = 132 os_tid = 0x96c Thread: id = 133 os_tid = 0x94c Thread: id = 134 os_tid = 0x940 Thread: id = 135 os_tid = 0x944 Thread: id = 136 os_tid = 0x988 Thread: id = 137 os_tid = 0x984 Thread: id = 160 os_tid = 0xa38 Thread: id = 161 os_tid = 0x8ac Thread: id = 162 os_tid = 0x8a4 Thread: id = 164 os_tid = 0x87c Thread: id = 165 os_tid = 0x878 Process: id = "3" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x66a03000" os_pid = "0x734" os_integrity_level = "0x4000" os_privileges = "0xe60b1e990" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x36c" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cedf" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 52 os_tid = 0x788 Thread: id = 53 os_tid = 0x3b0 Thread: id = 54 os_tid = 0x3c0 Thread: id = 55 os_tid = 0x5d8 Thread: id = 56 os_tid = 0x61c Thread: id = 57 os_tid = 0x53c Thread: id = 58 os_tid = 0x11c Thread: id = 59 os_tid = 0x7f0 Thread: id = 106 os_tid = 0xbbc Thread: id = 166 os_tid = 0x870 Thread: id = 169 os_tid = 0x8b4 Process: id = "4" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x47f16000" os_pid = "0xaf0" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x36c" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:000759e6" [0xc000000f] Thread: id = 64 os_tid = 0xaf4 Thread: id = 65 os_tid = 0xaf8 Thread: id = 66 os_tid = 0xafc Thread: id = 67 os_tid = 0xb00 Thread: id = 68 os_tid = 0xb04 Thread: id = 69 os_tid = 0xb08 Thread: id = 70 os_tid = 0xb0c Thread: id = 71 os_tid = 0xb10 Thread: id = 105 os_tid = 0xbb8 Thread: id = 167 os_tid = 0x86c Thread: id = 168 os_tid = 0x8bc Process: id = "5" image_name = "regasm.exe" filename = "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\regasm.exe" page_root = "0x47eac000" os_pid = "0xb14" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xa20" cmd_line = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 72 os_tid = 0xb18 [0042.207] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0042.673] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe.Config", nBufferLength=0x105, lpBuffer=0x3fed88, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe.Config", lpFilePart=0x0) returned 0x3f [0042.675] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe.Config", nBufferLength=0x105, lpBuffer=0x3fed34, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe.Config", lpFilePart=0x0) returned 0x3f [0042.719] GetCurrentProcess () returned 0xffffffff [0042.719] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3ff0dc | out: TokenHandle=0x3ff0dc*=0x1d4) returned 1 [0042.721] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x3febbc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0042.746] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x3ff0dc | out: lpFileInformation=0x3ff0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0cc4300, ftCreationTime.dwHighDateTime=0x1cd5cf4, ftLastAccessTime.dwLowDateTime=0xcf7ee640, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc0cc4300, ftLastWriteTime.dwHighDateTime=0x1cd5cf4, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0042.747] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x3feb88, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0042.749] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x3ff0dc | out: lpFileInformation=0x3ff0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0cc4300, ftCreationTime.dwHighDateTime=0x1cd5cf4, ftLastAccessTime.dwLowDateTime=0xcf7ee640, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc0cc4300, ftLastWriteTime.dwHighDateTime=0x1cd5cf4, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0042.749] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x3feb14, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0042.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x3ff008) returned 1 [0042.750] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x1e4 [0042.751] GetFileType (hFile=0x1e4) returned 0x1 [0042.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x3ff004) returned 1 [0042.751] GetFileType (hFile=0x1e4) returned 0x1 [0042.762] GetFileSize (in: hFile=0x1e4, lpFileSizeHigh=0x3ff0d0 | out: lpFileSizeHigh=0x3ff0d0*=0x0) returned 0x8c8f [0042.762] ReadFile (in: hFile=0x1e4, lpBuffer=0x259d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ff08c, lpOverlapped=0x0 | out: lpBuffer=0x259d1b8*, lpNumberOfBytesRead=0x3ff08c*=0x1000, lpOverlapped=0x0) returned 1 [0042.772] ReadFile (in: hFile=0x1e4, lpBuffer=0x259d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3fef28, lpOverlapped=0x0 | out: lpBuffer=0x259d1b8*, lpNumberOfBytesRead=0x3fef28*=0x1000, lpOverlapped=0x0) returned 1 [0042.773] ReadFile (in: hFile=0x1e4, lpBuffer=0x259d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3feddc, lpOverlapped=0x0 | out: lpBuffer=0x259d1b8*, lpNumberOfBytesRead=0x3feddc*=0x1000, lpOverlapped=0x0) returned 1 [0042.773] ReadFile (in: hFile=0x1e4, lpBuffer=0x259d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3feddc, lpOverlapped=0x0 | out: lpBuffer=0x259d1b8*, lpNumberOfBytesRead=0x3feddc*=0x1000, lpOverlapped=0x0) returned 1 [0042.774] ReadFile (in: hFile=0x1e4, lpBuffer=0x259d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3feddc, lpOverlapped=0x0 | out: lpBuffer=0x259d1b8*, lpNumberOfBytesRead=0x3feddc*=0x1000, lpOverlapped=0x0) returned 1 [0042.774] ReadFile (in: hFile=0x1e4, lpBuffer=0x259d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3fed14, lpOverlapped=0x0 | out: lpBuffer=0x259d1b8*, lpNumberOfBytesRead=0x3fed14*=0x1000, lpOverlapped=0x0) returned 1 [0042.776] ReadFile (in: hFile=0x1e4, lpBuffer=0x259d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3fee90, lpOverlapped=0x0 | out: lpBuffer=0x259d1b8*, lpNumberOfBytesRead=0x3fee90*=0x1000, lpOverlapped=0x0) returned 1 [0042.777] ReadFile (in: hFile=0x1e4, lpBuffer=0x259d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3feda4, lpOverlapped=0x0 | out: lpBuffer=0x259d1b8*, lpNumberOfBytesRead=0x3feda4*=0x1000, lpOverlapped=0x0) returned 1 [0042.777] ReadFile (in: hFile=0x1e4, lpBuffer=0x259d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3feda4, lpOverlapped=0x0 | out: lpBuffer=0x259d1b8*, lpNumberOfBytesRead=0x3feda4*=0xc8f, lpOverlapped=0x0) returned 1 [0042.778] ReadFile (in: hFile=0x1e4, lpBuffer=0x259d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3fee64, lpOverlapped=0x0 | out: lpBuffer=0x259d1b8*, lpNumberOfBytesRead=0x3fee64*=0x0, lpOverlapped=0x0) returned 1 [0042.778] CloseHandle (hObject=0x1e4) returned 1 [0042.779] GetCurrentProcess () returned 0xffffffff [0042.779] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3ff210 | out: TokenHandle=0x3ff210*=0x1e4) returned 1 [0042.779] GetCurrentProcess () returned 0xffffffff [0042.779] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3ff210 | out: TokenHandle=0x3ff210*=0x1e8) returned 1 [0042.780] GetCurrentProcess () returned 0xffffffff [0042.780] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3ff0dc | out: TokenHandle=0x3ff0dc*=0x1ec) returned 1 [0042.780] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe.Config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\regasm.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x3ff0dc | out: lpFileInformation=0x3ff0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b4b100, ftCreationTime.dwHighDateTime=0x1cac604, ftLastAccessTime.dwLowDateTime=0x8b4a2880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x53b4b100, ftLastWriteTime.dwHighDateTime=0x1cac604, nFileSizeHigh=0x0, nFileSizeLow=0x119)) returned 1 [0042.780] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe.Config", nBufferLength=0x105, lpBuffer=0x3feb88, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe.Config", lpFilePart=0x0) returned 0x3f [0042.780] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe.Config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\regasm.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x3ff0dc | out: lpFileInformation=0x3ff0dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b4b100, ftCreationTime.dwHighDateTime=0x1cac604, ftLastAccessTime.dwLowDateTime=0x8b4a2880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x53b4b100, ftLastWriteTime.dwHighDateTime=0x1cac604, nFileSizeHigh=0x0, nFileSizeLow=0x119)) returned 1 [0042.780] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe.Config", nBufferLength=0x105, lpBuffer=0x3feb14, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe.Config", lpFilePart=0x0) returned 0x3f [0042.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x3ff008) returned 1 [0042.780] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe.Config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\regasm.exe.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x1f0 [0042.780] GetFileType (hFile=0x1f0) returned 0x1 [0042.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x3ff004) returned 1 [0042.780] GetFileType (hFile=0x1f0) returned 0x1 [0042.781] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x3ff0d0 | out: lpFileSizeHigh=0x3ff0d0*=0x0) returned 0x119 [0042.781] ReadFile (in: hFile=0x1f0, lpBuffer=0x25b56b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ff08c, lpOverlapped=0x0 | out: lpBuffer=0x25b56b8*, lpNumberOfBytesRead=0x3ff08c*=0x119, lpOverlapped=0x0) returned 1 [0042.781] ReadFile (in: hFile=0x1f0, lpBuffer=0x25b56b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3fef50, lpOverlapped=0x0 | out: lpBuffer=0x25b56b8*, lpNumberOfBytesRead=0x3fef50*=0x0, lpOverlapped=0x0) returned 1 [0042.781] CloseHandle (hObject=0x1f0) returned 1 [0042.781] GetCurrentProcess () returned 0xffffffff [0042.781] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3ff210 | out: TokenHandle=0x3ff210*=0x1f0) returned 1 [0042.781] GetCurrentProcess () returned 0xffffffff [0042.782] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3ff210 | out: TokenHandle=0x3ff210*=0x1f4) returned 1 [0042.792] GetCurrentProcess () returned 0xffffffff [0042.792] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3fefd8 | out: TokenHandle=0x3fefd8*=0x1f8) returned 1 [0042.822] GetCurrentProcess () returned 0xffffffff [0042.822] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3fefe8 | out: TokenHandle=0x3fefe8*=0x1fc) returned 1 [0042.844] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x3fe658, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0042.845] GetModuleHandleW (lpModuleName="webengine4.dll") returned 0x0 [0042.846] LoadLibraryW (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\webengine4.dll") returned 0x74720000 [0042.870] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0042.870] CoUninitialize () [0042.894] EtwEventRegister () returned 0x0 [0042.901] GetCurrentProcess () returned 0xffffffff [0042.901] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3feb6c | out: TokenHandle=0x3feb6c*=0x248) returned 1 [0042.903] GetCurrentProcess () returned 0xffffffff [0042.903] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3feb40 | out: TokenHandle=0x3feb40*=0x264) returned 1 [0042.904] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x3feb74 | out: TokenInformation=0x0, ReturnLength=0x3feb74) returned 0 [0042.904] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x8fddd0 [0042.904] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0x8fddd0, TokenInformationLength=0x24, ReturnLength=0x3feb74 | out: TokenInformation=0x8fddd0, ReturnLength=0x3feb74) returned 1 [0042.906] LocalFree (hMem=0x8fddd0) returned 0x0 [0042.908] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x3fea94, DesiredAccess=0x800, PolicyHandle=0x3fea54 | out: PolicyHandle=0x3fea54) returned 0x0 [0042.909] LsaLookupSids (in: PolicyHandle=0x8e9780, Count=0x1, Sids=0x25bb914*=0x25bb880*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), ReferencedDomains=0x3fea70, Names=0x3fea64 | out: ReferencedDomains=0x3fea70, Names=0x3fea64) returned 0x0 [0042.911] LsaClose (ObjectHandle=0x8e9780) returned 0x0 [0042.911] LsaFreeMemory (Buffer=0x8f8248) returned 0x0 [0042.911] LsaFreeMemory (Buffer=0x8f9158) returned 0x0 [0042.947] FindResourceA (hModule=0x0, lpName=0x7f, lpType=0x17) returned 0x408228 [0042.950] SizeofResource (hModule=0x0, hResInfo=0x408228) returned 0x77200 [0042.953] LoadResource (hModule=0x0, hResInfo=0x408228) returned 0x4146d4 [0042.956] LockResource (hResData=0x4146d4) returned 0x4146d4 Thread: id = 73 os_tid = 0xb1c Thread: id = 74 os_tid = 0xb20 [0042.208] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0043.333] CloseHandle (hObject=0x1f0) returned 1 [0043.333] CloseHandle (hObject=0x248) returned 1 [0043.333] CloseHandle (hObject=0x1fc) returned 1 [0043.333] CloseHandle (hObject=0x1ec) returned 1 [0043.333] CloseHandle (hObject=0x1e8) returned 1 [0043.333] CloseHandle (hObject=0x1f8) returned 1 [0043.333] CloseHandle (hObject=0x1e4) returned 1 [0043.333] CloseHandle (hObject=0x264) returned 1 [0043.333] CloseHandle (hObject=0x1f4) returned 1 [0043.334] CloseHandle (hObject=0x1d4) returned 1 [0059.940] CoGetContextToken (in: pToken=0x249fab0 | out: pToken=0x249fab0) returned 0x0 [0059.941] CoGetContextToken (in: pToken=0x249fa38 | out: pToken=0x249fa38) returned 0x0 [0059.941] WbemLocator:IUnknown:Release (This=0x280a00) returned 0x1 [0059.941] WbemLocator:IUnknown:Release (This=0x280a00) returned 0x0 [0059.941] CoGetContextToken (in: pToken=0x249fa38 | out: pToken=0x249fa38) returned 0x0 [0059.941] IUnknown:Release (This=0x28d2e0) returned 0x2 [0059.941] IUnknown:Release (This=0x28d2e0) returned 0x1 [0059.941] IUnknown:Release (This=0x28d2e0) returned 0x0 [0059.941] CoGetContextToken (in: pToken=0x249f8d0 | out: pToken=0x249f8d0) returned 0x0 [0059.941] WbemLocator:IUnknown:Release (This=0x91e1e4) returned 0x1 [0059.941] IUnknown:Release (This=0x28c934) returned 0x0 [0059.986] RegCloseKey (hKey=0x1ec) returned 0x0 [0059.987] RegCloseKey (hKey=0x1e8) returned 0x0 [0059.987] RegCloseKey (hKey=0x1f8) returned 0x0 [0059.987] RegCloseKey (hKey=0x1e4) returned 0x0 [0059.987] RegCloseKey (hKey=0x1f4) returned 0x0 [0059.987] RegCloseKey (hKey=0x264) returned 0x0 [0060.003] CoGetContextToken (in: pToken=0x249fab0 | out: pToken=0x249fab0) returned 0x0 [0060.003] CoGetContextToken (in: pToken=0x249fa38 | out: pToken=0x249fa38) returned 0x0 [0060.003] WbemDefPath:IUnknown:Release (This=0x280820) returned 0x1 [0060.003] WbemDefPath:IUnknown:Release (This=0x280820) returned 0x0 [0060.003] CoGetContextToken (in: pToken=0x249fa38 | out: pToken=0x249fa38) returned 0x0 [0060.003] WbemDefPath:IUnknown:Release (This=0x293050) returned 0x1 [0060.003] WbemDefPath:IUnknown:Release (This=0x293050) returned 0x0 [0060.003] CoGetContextToken (in: pToken=0x249fab0 | out: pToken=0x249fab0) returned 0x0 [0060.003] CoGetContextToken (in: pToken=0x249fa38 | out: pToken=0x249fa38) returned 0x0 [0060.003] WbemLocator:IUnknown:Release (This=0x91e3c4) returned 0x1 [0060.003] WbemLocator:IUnknown:Release (This=0x28d204) returned 0x0 [0060.049] IUnknown:Release (This=0x8dcc98) returned 0x0 [0060.826] CloseHandle (hObject=0x474) returned 1 Thread: id = 75 os_tid = 0xb24 Thread: id = 76 os_tid = 0xb28 [0042.898] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0042.898] CoGetContextToken (in: pToken=0x4fbf60c | out: pToken=0x4fbf60c) returned 0x0 [0042.898] CObjectContext::QueryInterface () returned 0x0 [0042.898] CObjectContext::GetCurrentThreadType () returned 0x0 [0042.898] Release () returned 0x0 [0042.898] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0042.898] CoUninitialize () Thread: id = 77 os_tid = 0xb2c [0042.920] CoGetContextToken (in: pToken=0xd4fe9c | out: pToken=0xd4fe9c) returned 0x0 [0042.920] CObjectContext::QueryInterface () returned 0x0 [0042.920] CObjectContext::GetCurrentThreadType () returned 0x0 [0042.920] Release () returned 0x0 [0042.920] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0042.920] SleepEx (dwMilliseconds=0xffffffff, bAlertable=1) returned 0xc0 [0042.920] SleepEx (dwMilliseconds=0x3a98, bAlertable=1) returned 0x0 [0055.016] SleepEx (dwMilliseconds=0x1379, bAlertable=1) returned 0x0 [0062.186] SleepEx (dwMilliseconds=0xffffffff, bAlertable=1) returned 0xc0 [0062.246] SleepEx (dwMilliseconds=0x3a98, bAlertable=1) returned 0x0 [0072.259] SleepEx (dwMilliseconds=0x1379, bAlertable=1) returned 0x0 [0077.267] SleepEx (dwMilliseconds=0xffffffff, bAlertable=1) returned 0xc0 [0077.280] SleepEx (dwMilliseconds=0x3a98, bAlertable=1) Thread: id = 78 os_tid = 0xb30 [0042.968] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0044.790] CoTaskMemAlloc (cb=0x20c) returned 0x919890 [0044.790] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x919890 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0044.790] CoTaskMemFree (pv=0x919890) [0044.790] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x512e994, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0044.791] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x512e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31 [0044.891] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe", nBufferLength=0x105, lpBuffer=0x512e924, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe", lpFilePart=0x0) returned 0x38 [0045.062] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0", ulOptions=0x0, samDesired=0x20019, phkResult=0x512ec54 | out: phkResult=0x512ec54*=0x0) returned 0x2 [0045.067] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\Description\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x512ec54 | out: phkResult=0x512ec54*=0x264) returned 0x0 [0045.067] RegQueryValueExW (in: hKey=0x264, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x512ec6c, lpData=0x0, lpcbData=0x512ec68*=0x0 | out: lpType=0x512ec6c*=0x7, lpData=0x0, lpcbData=0x512ec68*=0x8c) returned 0x0 [0045.067] RegQueryValueExW (in: hKey=0x264, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x512ec6c, lpData=0x2583b2c, lpcbData=0x512ec68*=0x8c | out: lpType=0x512ec6c*=0x7, lpData=0x2583b2c*, lpcbData=0x512ec68*=0x8c) returned 0x0 [0045.069] RegQueryValueExW (in: hKey=0x264, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x512eca4, lpData=0x0, lpcbData=0x512eca0*=0x0 | out: lpType=0x512eca4*=0x7, lpData=0x0, lpcbData=0x512eca0*=0x8c) returned 0x0 [0045.070] RegQueryValueExW (in: hKey=0x264, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x512eca4, lpData=0x0, lpcbData=0x512eca0*=0x0 | out: lpType=0x512eca4*=0x7, lpData=0x0, lpcbData=0x512eca0*=0x8c) returned 0x0 [0045.093] RegQueryValueExW (in: hKey=0x264, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x512eca4, lpData=0x0, lpcbData=0x512eca0*=0x0 | out: lpType=0x512eca4*=0x7, lpData=0x0, lpcbData=0x512eca0*=0x8c) returned 0x0 [0045.118] RegQueryValueExW (in: hKey=0x264, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x512eca4, lpData=0x0, lpcbData=0x512eca0*=0x0 | out: lpType=0x512eca4*=0x7, lpData=0x0, lpcbData=0x512eca0*=0x8c) returned 0x0 [0045.140] RegQueryValueExW (in: hKey=0x264, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x512eca4, lpData=0x0, lpcbData=0x512eca0*=0x0 | out: lpType=0x512eca4*=0x7, lpData=0x0, lpcbData=0x512eca0*=0x8c) returned 0x0 [0045.140] RegQueryValueExW (in: hKey=0x264, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x512eca4, lpData=0x0, lpcbData=0x512eca0*=0x0 | out: lpType=0x512eca4*=0x7, lpData=0x0, lpcbData=0x512eca0*=0x8c) returned 0x0 [0045.141] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\Description\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x512ec54 | out: phkResult=0x512ec54*=0x1f4) returned 0x0 [0045.141] RegQueryValueExW (in: hKey=0x1f4, lpValueName="VideoBiosVersion", lpReserved=0x0, lpType=0x512ec6c, lpData=0x0, lpcbData=0x512ec68*=0x0 | out: lpType=0x512ec6c*=0x0, lpData=0x0, lpcbData=0x512ec68*=0x0) returned 0x2 [0045.141] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Oracle\\VirtualBox Guest Additions", ulOptions=0x0, samDesired=0x20019, phkResult=0x512ec54 | out: phkResult=0x512ec54*=0x0) returned 0x2 [0045.150] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\drivers\\VBoxMouse.sys" (normalized: "c:\\windows\\system32\\drivers\\vboxmouse.sys")) returned 0xffffffff [0045.150] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0", ulOptions=0x0, samDesired=0x20019, phkResult=0x512ec54 | out: phkResult=0x512ec54*=0x0) returned 0x2 [0045.151] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\VMware, Inc.\\VMware Tools", ulOptions=0x0, samDesired=0x20019, phkResult=0x512ec54 | out: phkResult=0x512ec54*=0x0) returned 0x2 [0045.152] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 1\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0", ulOptions=0x0, samDesired=0x20019, phkResult=0x512ec54 | out: phkResult=0x512ec54*=0x0) returned 0x2 [0045.152] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 2\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0", ulOptions=0x0, samDesired=0x20019, phkResult=0x512ec54 | out: phkResult=0x512ec54*=0x0) returned 0x2 [0045.152] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\ControlSet001\\Services\\Disk\\Enum", ulOptions=0x0, samDesired=0x20019, phkResult=0x512ec54 | out: phkResult=0x512ec54*=0x1e4) returned 0x0 [0045.153] RegQueryValueExW (in: hKey=0x1e4, lpValueName="0", lpReserved=0x0, lpType=0x512ec6c, lpData=0x0, lpcbData=0x512ec68*=0x0 | out: lpType=0x512ec6c*=0x1, lpData=0x0, lpcbData=0x512ec68*=0x98) returned 0x0 [0045.153] RegQueryValueExW (in: hKey=0x1e4, lpValueName="0", lpReserved=0x0, lpType=0x512ec6c, lpData=0x2585e44, lpcbData=0x512ec68*=0x98 | out: lpType=0x512ec6c*=0x1, lpData="IDE\\DiskHD502HI_________________________________OF90____\\5&37d1a386&0&0.0.0", lpcbData=0x512ec68*=0x98) returned 0x0 [0045.153] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000", ulOptions=0x0, samDesired=0x20019, phkResult=0x512ec54 | out: phkResult=0x512ec54*=0x1f8) returned 0x0 [0045.153] RegQueryValueExW (in: hKey=0x1f8, lpValueName="DriverDesc", lpReserved=0x0, lpType=0x512ec6c, lpData=0x0, lpcbData=0x512ec68*=0x0 | out: lpType=0x512ec6c*=0x1, lpData=0x0, lpcbData=0x512ec68*=0x3c) returned 0x0 [0045.153] RegQueryValueExW (in: hKey=0x1f8, lpValueName="DriverDesc", lpReserved=0x0, lpType=0x512ec6c, lpData=0x25863f0, lpcbData=0x512ec68*=0x3c | out: lpType=0x512ec6c*=0x1, lpData="Standard VGA Graphics Adapter", lpcbData=0x512ec68*=0x3c) returned 0x0 [0045.154] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x512ec54 | out: phkResult=0x512ec54*=0x1e8) returned 0x0 [0045.154] RegQueryValueExW (in: hKey=0x1e8, lpValueName="Device Description", lpReserved=0x0, lpType=0x512ec6c, lpData=0x0, lpcbData=0x512ec68*=0x0 | out: lpType=0x512ec6c*=0x1, lpData=0x0, lpcbData=0x512ec68*=0x3c) returned 0x0 [0045.154] RegQueryValueExW (in: hKey=0x1e8, lpValueName="Device Description", lpReserved=0x0, lpType=0x512ec6c, lpData=0x25868e0, lpcbData=0x512ec68*=0x3c | out: lpType=0x512ec6c*=0x1, lpData="Standard VGA Graphics Adapter", lpcbData=0x512ec68*=0x3c) returned 0x0 [0045.154] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\VMware, Inc.\\VMware Tools", ulOptions=0x0, samDesired=0x20019, phkResult=0x512ec54 | out: phkResult=0x512ec54*=0x0) returned 0x2 [0045.154] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\drivers\\vmmouse.sys" (normalized: "c:\\windows\\system32\\drivers\\vmmouse.sys")) returned 0xffffffff [0045.154] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\drivers\\vmhgfs.sys" (normalized: "c:\\windows\\system32\\drivers\\vmhgfs.sys")) returned 0xffffffff [0045.169] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0045.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wine_get_unix_file_name", cchWideChar=23, lpMultiByteStr=0x512ec5c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wine_get_unix_file_nametU÷\x17", lpUsedDefaultChar=0x0) returned 23 [0045.181] GetProcAddress (hModule=0x76c20000, lpProcName="wine_get_unix_file_name") returned 0x0 [0045.181] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0", ulOptions=0x0, samDesired=0x20019, phkResult=0x512ec54 | out: phkResult=0x512ec54*=0x0) returned 0x2 [0045.182] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\Description\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x512ec54 | out: phkResult=0x512ec54*=0x1ec) returned 0x0 [0045.183] RegQueryValueExW (in: hKey=0x1ec, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x512ec6c, lpData=0x0, lpcbData=0x512ec68*=0x0 | out: lpType=0x512ec6c*=0x7, lpData=0x0, lpcbData=0x512ec68*=0x8c) returned 0x0 [0045.183] RegQueryValueExW (in: hKey=0x1ec, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x512ec6c, lpData=0x258817c, lpcbData=0x512ec68*=0x8c | out: lpType=0x512ec6c*=0x7, lpData=0x258817c*, lpcbData=0x512ec68*=0x8c) returned 0x0 [0045.183] RegQueryValueExW (in: hKey=0x1ec, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x512eca4, lpData=0x0, lpcbData=0x512eca0*=0x0 | out: lpType=0x512eca4*=0x7, lpData=0x0, lpcbData=0x512eca0*=0x8c) returned 0x0 [0045.183] RegQueryValueExW (in: hKey=0x1ec, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x512eca4, lpData=0x0, lpcbData=0x512eca0*=0x0 | out: lpType=0x512eca4*=0x7, lpData=0x0, lpcbData=0x512eca0*=0x8c) returned 0x0 [0045.183] RegQueryValueExW (in: hKey=0x1ec, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x512eca4, lpData=0x0, lpcbData=0x512eca0*=0x0 | out: lpType=0x512eca4*=0x7, lpData=0x0, lpcbData=0x512eca0*=0x8c) returned 0x0 [0045.183] RegQueryValueExW (in: hKey=0x1ec, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x512eca4, lpData=0x0, lpcbData=0x512eca0*=0x0 | out: lpType=0x512eca4*=0x7, lpData=0x0, lpcbData=0x512eca0*=0x8c) returned 0x0 [0045.184] RegQueryValueExW (in: hKey=0x1ec, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x512eca4, lpData=0x0, lpcbData=0x512eca0*=0x0 | out: lpType=0x512eca4*=0x7, lpData=0x0, lpcbData=0x512eca0*=0x8c) returned 0x0 [0045.184] RegQueryValueExW (in: hKey=0x1ec, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x512eca4, lpData=0x0, lpcbData=0x512eca0*=0x0 | out: lpType=0x512eca4*=0x7, lpData=0x0, lpcbData=0x512eca0*=0x8c) returned 0x0 [0045.191] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x1fc [0045.192] CoGetObjectContext (in: riid=0x258858c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x512ec64 | out: ppv=0x512ec64*=0x8dcca4) returned 0x0 [0045.240] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x512def8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0045.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", cchWideChar=63, lpMultiByteStr=0x512e3f8, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", lpUsedDefaultChar=0x0) returned 63 [0045.240] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll") returned 0x73da0000 [0045.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResetSecurity", cchWideChar=13, lpMultiByteStr=0x512e42c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResetSecurity\x1aèsëÅW\x1e\x94Âðsìæ\x12\x05¸Q\x91", lpUsedDefaultChar=0x0) returned 13 [0045.243] GetProcAddress (hModule=0x73da0000, lpProcName="ResetSecurity") returned 0x73da24de [0045.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetSecurity", cchWideChar=11, lpMultiByteStr=0x512e42c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetSecurity", lpUsedDefaultChar=0x0) returned 11 [0045.251] GetProcAddress (hModule=0x73da0000, lpProcName="SetSecurity") returned 0x73da2520 [0045.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServices", cchWideChar=18, lpMultiByteStr=0x512e428, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesèsëÅW\x1e\x94Âðsìæ\x12\x05", lpUsedDefaultChar=0x0) returned 18 [0045.263] GetProcAddress (hModule=0x73da0000, lpProcName="BlessIWbemServices") returned 0x73da1c69 [0045.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x512e420, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObjectD\x1aèsëÅW\x1e\x94Âðsìæ\x12\x05", lpUsedDefaultChar=0x0) returned 24 [0045.275] GetProcAddress (hModule=0x73da0000, lpProcName="BlessIWbemServicesObject") returned 0x73da1cbb [0045.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyHandle", cchWideChar=17, lpMultiByteStr=0x512e428, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyHandle\x1aèsëÅW\x1e\x94Âðsìæ\x12\x05", lpUsedDefaultChar=0x0) returned 17 [0045.281] GetProcAddress (hModule=0x73da0000, lpProcName="GetPropertyHandle") returned 0x73da21b4 [0045.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WritePropertyValue", cchWideChar=18, lpMultiByteStr=0x512e428, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WritePropertyValueèsëÅW\x1e\x94Âðsìæ\x12\x05", lpUsedDefaultChar=0x0) returned 18 [0045.285] GetProcAddress (hModule=0x73da0000, lpProcName="WritePropertyValue") returned 0x73da2617 [0045.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x512e434, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone\x1aèsëÅW\x1e\x94Âðsìæ\x12\x05", lpUsedDefaultChar=0x0) returned 5 [0045.290] GetProcAddress (hModule=0x73da0000, lpProcName="Clone") returned 0x73da1d0d [0045.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VerifyClientKey", cchWideChar=15, lpMultiByteStr=0x512e428, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VerifyClientKey", lpUsedDefaultChar=0x0) returned 15 [0045.293] GetProcAddress (hModule=0x73da0000, lpProcName="VerifyClientKey") returned 0x73da25b4 [0045.317] IComThreadingInfo:GetCurrentApartmentType (in: This=0x8dcca4, pAptType=0x512ec5c | out: pAptType=0x512ec5c*=1) returned 0x0 [0045.317] IUnknown:QueryInterface (in: This=0x8dcca4, riid=0x2588574*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x512ec60 | out: ppvObject=0x512ec60*=0x0) returned 0x80004002 [0045.317] IUnknown:Release (This=0x8dcca4) returned 0x0 [0045.329] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x512e8bc | out: lpiid=0x512e8bc) returned 0x0 [0045.330] CoGetClassObject (in: rclsid=0x8ca3a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x73fad1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x512e5d0 | out: ppv=0x512e5d0*=0x280810) returned 0x0 [0045.342] WbemDefPath:IUnknown:QueryInterface (in: This=0x280810, riid=0x73fe0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x512e7e8 | out: ppvObject=0x512e7e8*=0x0) returned 0x80004002 [0045.342] WbemDefPath:IClassFactory:CreateInstance (in: This=0x280810, pUnkOuter=0x0, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512e7fc | out: ppvObject=0x512e7fc*=0x280820) returned 0x0 [0045.342] WbemDefPath:IUnknown:Release (This=0x280810) returned 0x0 [0045.342] WbemDefPath:IUnknown:QueryInterface (in: This=0x280820, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512e41c | out: ppvObject=0x512e41c*=0x280820) returned 0x0 [0045.345] WbemDefPath:IUnknown:QueryInterface (in: This=0x280820, riid=0x7404fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x512e3d8 | out: ppvObject=0x512e3d8*=0x0) returned 0x80004002 [0045.345] WbemDefPath:IUnknown:AddRef (This=0x280820) returned 0x3 [0045.345] WbemDefPath:IUnknown:QueryInterface (in: This=0x280820, riid=0x7404f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x512dd34 | out: ppvObject=0x512dd34*=0x0) returned 0x80004002 [0045.345] WbemDefPath:IUnknown:QueryInterface (in: This=0x280820, riid=0x7404f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x512dce4 | out: ppvObject=0x512dce4*=0x0) returned 0x80004002 [0045.345] WbemDefPath:IUnknown:QueryInterface (in: This=0x280820, riid=0x7403c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512dcf0 | out: ppvObject=0x512dcf0*=0x91af40) returned 0x0 [0045.345] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x91af40, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x512dcf8 | out: pCid=0x512dcf8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0045.345] WbemDefPath:IUnknown:Release (This=0x91af40) returned 0x3 [0045.345] CoGetContextToken (in: pToken=0x512dd50 | out: pToken=0x512dd50) returned 0x0 [0045.345] CoGetContextToken (in: pToken=0x512e158 | out: pToken=0x512e158) returned 0x0 [0045.345] WbemDefPath:IUnknown:QueryInterface (in: This=0x280820, riid=0x7404fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512e1e8 | out: ppvObject=0x512e1e8*=0x0) returned 0x80004002 [0045.345] WbemDefPath:IUnknown:Release (This=0x280820) returned 0x2 [0045.345] WbemDefPath:IUnknown:Release (This=0x280820) returned 0x1 [0045.346] CoGetContextToken (in: pToken=0x512eae0 | out: pToken=0x512eae0) returned 0x0 [0045.346] CoGetContextToken (in: pToken=0x512ea40 | out: pToken=0x512ea40) returned 0x0 [0045.346] WbemDefPath:IUnknown:QueryInterface (in: This=0x280820, riid=0x512eb10*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x512eb0c | out: ppvObject=0x512eb0c*=0x280820) returned 0x0 [0045.346] WbemDefPath:IUnknown:AddRef (This=0x280820) returned 0x3 [0045.346] WbemDefPath:IUnknown:Release (This=0x280820) returned 0x2 [0045.347] WbemDefPath:IWbemPath:SetText (This=0x280820, uMode=0x4, pszPath="\\\\.\\ROOT\\cimv2") returned 0x0 [0045.348] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x280820, puCount=0x512ec8c | out: puCount=0x512ec8c*=0x2) returned 0x0 [0045.348] WbemDefPath:IWbemPath:GetText (in: This=0x280820, lFlags=4, puBuffLength=0x512ec88*=0x0, pszText=0x0 | out: puBuffLength=0x512ec88*=0xf, pszText=0x0) returned 0x0 [0045.348] WbemDefPath:IWbemPath:GetText (in: This=0x280820, lFlags=4, puBuffLength=0x512ec88*=0xf, pszText="00000000000000" | out: puBuffLength=0x512ec88*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0 [0045.353] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x280820, puCount=0x512ec74 | out: puCount=0x512ec74*=0x2) returned 0x0 [0045.353] WbemDefPath:IWbemPath:GetText (in: This=0x280820, lFlags=4, puBuffLength=0x512ec70*=0x0, pszText=0x0 | out: puBuffLength=0x512ec70*=0xf, pszText=0x0) returned 0x0 [0045.353] WbemDefPath:IWbemPath:GetText (in: This=0x280820, lFlags=4, puBuffLength=0x512ec70*=0xf, pszText="00000000000000" | out: puBuffLength=0x512ec70*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0 [0045.354] CoGetObjectContext (in: riid=0x258858c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x512ec04 | out: ppv=0x512ec04*=0x8dcca4) returned 0x0 [0045.354] IComThreadingInfo:GetCurrentApartmentType (in: This=0x8dcca4, pAptType=0x512ebfc | out: pAptType=0x512ebfc*=1) returned 0x0 [0045.354] IUnknown:QueryInterface (in: This=0x8dcca4, riid=0x2588574*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x512ec00 | out: ppvObject=0x512ec00*=0x0) returned 0x80004002 [0045.354] IUnknown:Release (This=0x8dcca4) returned 0x0 [0045.354] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x512eb0c | out: lpiid=0x512eb0c) returned 0x0 [0045.355] CoGetClassObject (in: rclsid=0x93b034*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x73fad1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x512e820 | out: ppv=0x512e820*=0x2808e0) returned 0x0 [0045.357] WbemLocator:IUnknown:QueryInterface (in: This=0x2808e0, riid=0x73fe0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x512ea38 | out: ppvObject=0x512ea38*=0x0) returned 0x80004002 [0045.357] WbemLocator:IClassFactory:CreateInstance (in: This=0x2808e0, pUnkOuter=0x0, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512ea4c | out: ppvObject=0x512ea4c*=0x280a00) returned 0x0 [0045.357] WbemLocator:IUnknown:Release (This=0x2808e0) returned 0x0 [0045.357] WbemLocator:IUnknown:QueryInterface (in: This=0x280a00, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512e66c | out: ppvObject=0x512e66c*=0x280a00) returned 0x0 [0045.358] WbemLocator:IUnknown:QueryInterface (in: This=0x280a00, riid=0x7404fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x512e628 | out: ppvObject=0x512e628*=0x0) returned 0x80004002 [0045.358] WbemLocator:IUnknown:AddRef (This=0x280a00) returned 0x3 [0045.358] WbemLocator:IUnknown:QueryInterface (in: This=0x280a00, riid=0x7404f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x512df84 | out: ppvObject=0x512df84*=0x0) returned 0x80004002 [0045.358] WbemLocator:IUnknown:QueryInterface (in: This=0x280a00, riid=0x7404f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x512df34 | out: ppvObject=0x512df34*=0x0) returned 0x80004002 [0045.358] WbemLocator:IUnknown:QueryInterface (in: This=0x280a00, riid=0x7403c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512df40 | out: ppvObject=0x512df40*=0x0) returned 0x80004002 [0045.358] CoGetContextToken (in: pToken=0x512dfa0 | out: pToken=0x512dfa0) returned 0x0 [0045.358] CoGetObjectContext (in: riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x9378a4 | out: ppv=0x9378a4*=0x8dcc98) returned 0x0 [0045.358] CoGetContextToken (in: pToken=0x512e3a8 | out: pToken=0x512e3a8) returned 0x0 [0045.358] WbemLocator:IUnknown:QueryInterface (in: This=0x280a00, riid=0x7404fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512e438 | out: ppvObject=0x512e438*=0x0) returned 0x80004002 [0045.358] WbemLocator:IUnknown:Release (This=0x280a00) returned 0x2 [0045.358] WbemLocator:IUnknown:Release (This=0x280a00) returned 0x1 [0045.358] CoGetContextToken (in: pToken=0x512ea18 | out: pToken=0x512ea18) returned 0x0 [0045.358] CoGetContextToken (in: pToken=0x512e978 | out: pToken=0x512e978) returned 0x0 [0045.358] WbemLocator:IUnknown:QueryInterface (in: This=0x280a00, riid=0x512ea48*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x512ea44 | out: ppvObject=0x512ea44*=0x280a00) returned 0x0 [0045.358] WbemLocator:IUnknown:AddRef (This=0x280a00) returned 0x3 [0045.358] WbemLocator:IUnknown:Release (This=0x280a00) returned 0x2 [0045.360] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x280820, puCount=0x512ebe0 | out: puCount=0x512ebe0*=0x2) returned 0x0 [0045.360] WbemDefPath:IWbemPath:GetText (in: This=0x280820, lFlags=8, puBuffLength=0x512ebdc*=0x0, pszText=0x0 | out: puBuffLength=0x512ebdc*=0xf, pszText=0x0) returned 0x0 [0045.360] WbemDefPath:IWbemPath:GetText (in: This=0x280820, lFlags=8, puBuffLength=0x512ebdc*=0xf, pszText="00000000000000" | out: puBuffLength=0x512ebdc*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0 [0045.360] CoCreateInstance (in: rclsid=0x73da1284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x73da12e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x512eab8 | out: ppv=0x512eab8*=0x280a10) returned 0x0 [0045.360] WbemLocator:IWbemLocator:ConnectServer (in: This=0x280a10, strNetworkResource="\\\\.\\ROOT\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x512eb4c | out: ppNamespace=0x512eb4c*=0x28d204) returned 0x0 [0045.383] WbemLocator:IUnknown:QueryInterface (in: This=0x28d204, riid=0x73da1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512e9e8 | out: ppvObject=0x512e9e8*=0x91e3a4) returned 0x0 [0045.383] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x91e3a4, pProxy=0x28d204, pAuthnSvc=0x512ea38, pAuthzSvc=0x512ea34, pServerPrincName=0x512ea2c, pAuthnLevel=0x512ea30, pImpLevel=0x512ea20, pAuthInfo=0x512ea24, pCapabilites=0x512ea28 | out: pAuthnSvc=0x512ea38*=0xa, pAuthzSvc=0x512ea34*=0x0, pServerPrincName=0x512ea2c, pAuthnLevel=0x512ea30*=0x6, pImpLevel=0x512ea20*=0x2, pAuthInfo=0x512ea24, pCapabilites=0x512ea28*=0x1) returned 0x0 [0045.383] WbemLocator:IUnknown:Release (This=0x91e3a4) returned 0x1 [0045.383] WbemLocator:IUnknown:QueryInterface (in: This=0x28d204, riid=0x73da10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512e9dc | out: ppvObject=0x512e9dc*=0x91e3c4) returned 0x0 [0045.383] WbemLocator:IUnknown:QueryInterface (in: This=0x28d204, riid=0x73da1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512e9d8 | out: ppvObject=0x512e9d8*=0x91e3a4) returned 0x0 [0045.384] WbemLocator:IClientSecurity:SetBlanket (This=0x91e3a4, pProxy=0x28d204, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0045.384] WbemLocator:IUnknown:Release (This=0x91e3a4) returned 0x2 [0045.384] WbemLocator:IUnknown:Release (This=0x91e3c4) returned 0x1 [0045.384] CoTaskMemFree (pv=0x93b1d8) [0045.384] WbemLocator:IUnknown:Release (This=0x280a10) returned 0x0 [0045.384] WbemLocator:IUnknown:QueryInterface (in: This=0x28d204, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512e5d8 | out: ppvObject=0x512e5d8*=0x91e3c4) returned 0x0 [0045.384] WbemLocator:IUnknown:QueryInterface (in: This=0x91e3c4, riid=0x7404fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x512e594 | out: ppvObject=0x512e594*=0x0) returned 0x80004002 [0045.384] WbemLocator:IUnknown:QueryInterface (in: This=0x91e3c4, riid=0x7404fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x512e3b4 | out: ppvObject=0x512e3b4*=0x0) returned 0x80004002 [0045.384] WbemLocator:IUnknown:AddRef (This=0x91e3c4) returned 0x3 [0045.384] WbemLocator:IUnknown:QueryInterface (in: This=0x91e3c4, riid=0x7404f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x512def4 | out: ppvObject=0x512def4*=0x0) returned 0x80004002 [0045.385] WbemLocator:IUnknown:QueryInterface (in: This=0x91e3c4, riid=0x7404f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x512dea4 | out: ppvObject=0x512dea4*=0x0) returned 0x80004002 [0045.385] WbemLocator:IUnknown:QueryInterface (in: This=0x91e3c4, riid=0x7403c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512deb0 | out: ppvObject=0x512deb0*=0x91e324) returned 0x0 [0045.385] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x91e324, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x512deb8 | out: pCid=0x512deb8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0045.385] WbemLocator:IUnknown:Release (This=0x91e324) returned 0x3 [0045.385] CoGetContextToken (in: pToken=0x512df10 | out: pToken=0x512df10) returned 0x0 [0045.385] CoGetContextToken (in: pToken=0x512e318 | out: pToken=0x512e318) returned 0x0 [0045.385] WbemLocator:IUnknown:QueryInterface (in: This=0x91e3c4, riid=0x7404fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512e3a8 | out: ppvObject=0x512e3a8*=0x91e3ac) returned 0x0 [0045.385] WbemLocator:IRpcOptions:Query (in: This=0x91e3ac, pPrx=0x91e3c4, dwProperty=2, pdwValue=0x512e3d0 | out: pdwValue=0x512e3d0) returned 0x80004002 [0045.385] WbemLocator:IUnknown:Release (This=0x91e3ac) returned 0x3 [0045.385] WbemLocator:IUnknown:Release (This=0x91e3c4) returned 0x2 [0045.385] CoGetContextToken (in: pToken=0x512e8e8 | out: pToken=0x512e8e8) returned 0x0 [0045.385] CoGetContextToken (in: pToken=0x512e848 | out: pToken=0x512e848) returned 0x0 [0045.385] WbemLocator:IUnknown:QueryInterface (in: This=0x91e3c4, riid=0x512e918*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x512e914 | out: ppvObject=0x512e914*=0x28d204) returned 0x0 [0045.385] WbemLocator:IUnknown:AddRef (This=0x28d204) returned 0x4 [0045.385] WbemLocator:IUnknown:Release (This=0x28d204) returned 0x3 [0045.385] WbemLocator:IUnknown:Release (This=0x28d204) returned 0x2 [0045.390] SysStringLen (param_1=0x0) returned 0x0 [0045.390] CoGetContextToken (in: pToken=0x512e8e0 | out: pToken=0x512e8e0) returned 0x0 [0045.390] WbemLocator:IUnknown:AddRef (This=0x91e3c4) returned 0x3 [0045.391] WbemLocator:IUnknown:QueryInterface (in: This=0x91e3c4, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512e774 | out: ppvObject=0x512e774*=0x91e3c4) returned 0x0 [0045.391] WbemLocator:IUnknown:Release (This=0x91e3c4) returned 0x3 [0045.391] WbemLocator:IUnknown:Release (This=0x91e3c4) returned 0x2 [0045.391] CoGetContextToken (in: pToken=0x512e9d0 | out: pToken=0x512e9d0) returned 0x0 [0045.391] WbemLocator:IUnknown:AddRef (This=0x28d204) returned 0x3 [0045.391] IWbemServices:ExecQuery (in: This=0x28d204, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_VideoController", lFlags=16, pCtx=0x0, ppEnum=0x512ebe8 | out: ppEnum=0x512ebe8*=0x28c934) returned 0x0 [0045.412] IUnknown:QueryInterface (in: This=0x28c934, riid=0x73da1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512ea40 | out: ppvObject=0x512ea40*=0x28c938) returned 0x0 [0045.412] IClientSecurity:QueryBlanket (in: This=0x28c938, pProxy=0x28c934, pAuthnSvc=0x512ea90, pAuthzSvc=0x512ea8c, pServerPrincName=0x512ea84, pAuthnLevel=0x512ea88, pImpLevel=0x512ea78, pAuthInfo=0x512ea7c, pCapabilites=0x512ea80 | out: pAuthnSvc=0x512ea90*=0xa, pAuthzSvc=0x512ea8c*=0x0, pServerPrincName=0x512ea84, pAuthnLevel=0x512ea88*=0x6, pImpLevel=0x512ea78*=0x2, pAuthInfo=0x512ea7c, pCapabilites=0x512ea80*=0x1) returned 0x0 [0045.412] IUnknown:Release (This=0x28c938) returned 0x1 [0045.412] IUnknown:QueryInterface (in: This=0x28c934, riid=0x73da10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512ea34 | out: ppvObject=0x512ea34*=0x91e1e4) returned 0x0 [0045.412] IUnknown:QueryInterface (in: This=0x28c934, riid=0x73da1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512ea30 | out: ppvObject=0x512ea30*=0x28c938) returned 0x0 [0045.412] IClientSecurity:SetBlanket (This=0x28c938, pProxy=0x28c934, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0045.428] IUnknown:Release (This=0x28c938) returned 0x2 [0045.428] WbemLocator:IUnknown:Release (This=0x91e1e4) returned 0x1 [0045.428] CoTaskMemFree (pv=0x93b208) [0045.428] IUnknown:QueryInterface (in: This=0x28c934, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512e62c | out: ppvObject=0x512e62c*=0x91e1e4) returned 0x0 [0045.428] WbemLocator:IUnknown:QueryInterface (in: This=0x91e1e4, riid=0x7404fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x512e5e8 | out: ppvObject=0x512e5e8*=0x0) returned 0x80004002 [0045.428] WbemLocator:IUnknown:QueryInterface (in: This=0x91e1e4, riid=0x7404fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x512e404 | out: ppvObject=0x512e404*=0x0) returned 0x80004002 [0045.428] WbemLocator:IUnknown:AddRef (This=0x91e1e4) returned 0x3 [0045.428] WbemLocator:IUnknown:QueryInterface (in: This=0x91e1e4, riid=0x7404f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x512df44 | out: ppvObject=0x512df44*=0x0) returned 0x80004002 [0045.429] WbemLocator:IUnknown:QueryInterface (in: This=0x91e1e4, riid=0x7404f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x512def4 | out: ppvObject=0x512def4*=0x0) returned 0x80004002 [0045.429] WbemLocator:IUnknown:QueryInterface (in: This=0x91e1e4, riid=0x7403c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512df00 | out: ppvObject=0x512df00*=0x91e144) returned 0x0 [0045.429] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x91e144, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x512df08 | out: pCid=0x512df08*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0045.429] WbemLocator:IUnknown:Release (This=0x91e144) returned 0x3 [0045.429] CoGetContextToken (in: pToken=0x512df60 | out: pToken=0x512df60) returned 0x0 [0045.429] CoGetContextToken (in: pToken=0x512e368 | out: pToken=0x512e368) returned 0x0 [0045.429] WbemLocator:IUnknown:QueryInterface (in: This=0x91e1e4, riid=0x7404fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512e3f8 | out: ppvObject=0x512e3f8*=0x91e1cc) returned 0x0 [0045.429] WbemLocator:IRpcOptions:Query (in: This=0x91e1cc, pPrx=0x91e1e4, dwProperty=2, pdwValue=0x512e420 | out: pdwValue=0x512e420) returned 0x80004002 [0045.429] WbemLocator:IUnknown:Release (This=0x91e1cc) returned 0x3 [0045.429] WbemLocator:IUnknown:Release (This=0x91e1e4) returned 0x2 [0045.429] CoGetContextToken (in: pToken=0x512e940 | out: pToken=0x512e940) returned 0x0 [0045.429] CoGetContextToken (in: pToken=0x512e8a0 | out: pToken=0x512e8a0) returned 0x0 [0045.429] WbemLocator:IUnknown:QueryInterface (in: This=0x91e1e4, riid=0x512e970*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x512e96c | out: ppvObject=0x512e96c*=0x28c934) returned 0x0 [0045.429] IUnknown:AddRef (This=0x28c934) returned 0x4 [0045.429] IUnknown:Release (This=0x28c934) returned 0x3 [0045.429] IUnknown:Release (This=0x28c934) returned 0x2 [0045.429] WbemLocator:IUnknown:Release (This=0x28d204) returned 0x2 [0045.429] SysStringLen (param_1=0x0) returned 0x0 [0045.429] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x280820, puCount=0x512ec34 | out: puCount=0x512ec34*=0x2) returned 0x0 [0045.429] WbemDefPath:IWbemPath:GetText (in: This=0x280820, lFlags=4, puBuffLength=0x512ec30*=0x0, pszText=0x0 | out: puBuffLength=0x512ec30*=0xf, pszText=0x0) returned 0x0 [0045.430] WbemDefPath:IWbemPath:GetText (in: This=0x280820, lFlags=4, puBuffLength=0x512ec30*=0xf, pszText="00000000000000" | out: puBuffLength=0x512ec30*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0 [0045.430] CoGetContextToken (in: pToken=0x512ea80 | out: pToken=0x512ea80) returned 0x0 [0045.430] IUnknown:AddRef (This=0x28c934) returned 0x3 [0045.430] IEnumWbemClassObject:Clone (in: This=0x28c934, ppEnum=0x512ec40 | out: ppEnum=0x512ec40*=0x28d2a4) returned 0x0 [0045.430] IUnknown:QueryInterface (in: This=0x28d2a4, riid=0x73da1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512eb04 | out: ppvObject=0x512eb04*=0x28d2a8) returned 0x0 [0045.430] IClientSecurity:QueryBlanket (in: This=0x28d2a8, pProxy=0x28d2a4, pAuthnSvc=0x512eb54, pAuthzSvc=0x512eb50, pServerPrincName=0x512eb48, pAuthnLevel=0x512eb4c, pImpLevel=0x512eb3c, pAuthInfo=0x512eb40, pCapabilites=0x512eb44 | out: pAuthnSvc=0x512eb54*=0xa, pAuthzSvc=0x512eb50*=0x0, pServerPrincName=0x512eb48, pAuthnLevel=0x512eb4c*=0x6, pImpLevel=0x512eb3c*=0x2, pAuthInfo=0x512eb40, pCapabilites=0x512eb44*=0x1) returned 0x0 [0045.430] IUnknown:Release (This=0x28d2a8) returned 0x1 [0045.430] IUnknown:QueryInterface (in: This=0x28d2a4, riid=0x73da10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512eaf8 | out: ppvObject=0x512eaf8*=0x91e5a4) returned 0x0 [0045.430] IUnknown:QueryInterface (in: This=0x28d2a4, riid=0x73da1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512eaf4 | out: ppvObject=0x512eaf4*=0x28d2a8) returned 0x0 [0045.430] IClientSecurity:SetBlanket (This=0x28d2a8, pProxy=0x28d2a4, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0045.432] IUnknown:Release (This=0x28d2a8) returned 0x2 [0045.432] WbemLocator:IUnknown:Release (This=0x91e5a4) returned 0x1 [0045.432] CoTaskMemFree (pv=0x93b1a8) [0045.432] IUnknown:QueryInterface (in: This=0x28d2a4, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512e6e0 | out: ppvObject=0x512e6e0*=0x91e5a4) returned 0x0 [0045.432] WbemLocator:IUnknown:QueryInterface (in: This=0x91e5a4, riid=0x7404fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x512e69c | out: ppvObject=0x512e69c*=0x0) returned 0x80004002 [0045.432] WbemLocator:IUnknown:QueryInterface (in: This=0x91e5a4, riid=0x7404fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x512e4bc | out: ppvObject=0x512e4bc*=0x0) returned 0x80004002 [0045.432] WbemLocator:IUnknown:AddRef (This=0x91e5a4) returned 0x3 [0045.432] WbemLocator:IUnknown:QueryInterface (in: This=0x91e5a4, riid=0x7404f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x512dffc | out: ppvObject=0x512dffc*=0x0) returned 0x80004002 [0045.433] WbemLocator:IUnknown:QueryInterface (in: This=0x91e5a4, riid=0x7404f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x512dfac | out: ppvObject=0x512dfac*=0x0) returned 0x80004002 [0045.433] WbemLocator:IUnknown:QueryInterface (in: This=0x91e5a4, riid=0x7403c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512dfb8 | out: ppvObject=0x512dfb8*=0x91e504) returned 0x0 [0045.433] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x91e504, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x512dfc0 | out: pCid=0x512dfc0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0045.433] WbemLocator:IUnknown:Release (This=0x91e504) returned 0x3 [0045.433] CoGetContextToken (in: pToken=0x512e018 | out: pToken=0x512e018) returned 0x0 [0045.433] CoGetContextToken (in: pToken=0x512e420 | out: pToken=0x512e420) returned 0x0 [0045.433] WbemLocator:IUnknown:QueryInterface (in: This=0x91e5a4, riid=0x7404fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512e4b0 | out: ppvObject=0x512e4b0*=0x91e58c) returned 0x0 [0045.433] WbemLocator:IRpcOptions:Query (in: This=0x91e58c, pPrx=0x91e5a4, dwProperty=2, pdwValue=0x512e4d8 | out: pdwValue=0x512e4d8) returned 0x80004002 [0045.433] WbemLocator:IUnknown:Release (This=0x91e58c) returned 0x3 [0045.433] WbemLocator:IUnknown:Release (This=0x91e5a4) returned 0x2 [0045.433] CoGetContextToken (in: pToken=0x512e9f0 | out: pToken=0x512e9f0) returned 0x0 [0045.433] CoGetContextToken (in: pToken=0x512e950 | out: pToken=0x512e950) returned 0x0 [0045.433] WbemLocator:IUnknown:QueryInterface (in: This=0x91e5a4, riid=0x512ea20*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x512ea1c | out: ppvObject=0x512ea1c*=0x28d2a4) returned 0x0 [0045.433] IUnknown:AddRef (This=0x28d2a4) returned 0x4 [0045.433] IUnknown:Release (This=0x28d2a4) returned 0x3 [0045.433] IUnknown:Release (This=0x28d2a4) returned 0x2 [0045.433] IUnknown:Release (This=0x28c934) returned 0x2 [0045.433] SysStringLen (param_1=0x0) returned 0x0 [0045.434] IEnumWbemClassObject:Reset (This=0x28d2a4) returned 0x0 [0045.435] CoTaskMemAlloc (cb=0x4) returned 0x91b020 [0045.436] IEnumWbemClassObject:Next (in: This=0x28d2a4, lTimeout=-1, uCount=0x1, apObjects=0x91b020, puReturned=0x258da38 | out: apObjects=0x91b020*=0x28d2e0, puReturned=0x258da38*=0x1) returned 0x0 [0045.467] IUnknown:QueryInterface (in: This=0x28d2e0, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512e2a0 | out: ppvObject=0x512e2a0*=0x28d2e0) returned 0x0 [0045.467] IUnknown:QueryInterface (in: This=0x28d2e0, riid=0x7404fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x512e25c | out: ppvObject=0x512e25c*=0x0) returned 0x80004002 [0045.467] IUnknown:QueryInterface (in: This=0x28d2e0, riid=0x7404fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x512e07c | out: ppvObject=0x512e07c*=0x0) returned 0x80004002 [0045.467] IUnknown:AddRef (This=0x28d2e0) returned 0x3 [0045.467] IUnknown:QueryInterface (in: This=0x28d2e0, riid=0x7404f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x512dbbc | out: ppvObject=0x512dbbc*=0x0) returned 0x80004002 [0045.467] IUnknown:QueryInterface (in: This=0x28d2e0, riid=0x7404f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x512db6c | out: ppvObject=0x512db6c*=0x0) returned 0x80004002 [0045.467] IUnknown:QueryInterface (in: This=0x28d2e0, riid=0x7403c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512db78 | out: ppvObject=0x512db78*=0x28d2e4) returned 0x0 [0045.467] IMarshal:GetUnmarshalClass (in: This=0x28d2e4, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x512db80 | out: pCid=0x512db80*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0045.467] IUnknown:Release (This=0x28d2e4) returned 0x3 [0045.467] CoGetContextToken (in: pToken=0x512dbd8 | out: pToken=0x512dbd8) returned 0x0 [0045.467] CoGetContextToken (in: pToken=0x512dfe0 | out: pToken=0x512dfe0) returned 0x0 [0045.467] IUnknown:QueryInterface (in: This=0x28d2e0, riid=0x7404fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512e070 | out: ppvObject=0x512e070*=0x0) returned 0x80004002 [0045.467] IUnknown:Release (This=0x28d2e0) returned 0x2 [0045.467] CoGetContextToken (in: pToken=0x512e5b0 | out: pToken=0x512e5b0) returned 0x0 [0045.467] CoGetContextToken (in: pToken=0x512e510 | out: pToken=0x512e510) returned 0x0 [0045.467] IUnknown:QueryInterface (in: This=0x28d2e0, riid=0x512e5e0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x512e5dc | out: ppvObject=0x512e5dc*=0x28d2e0) returned 0x0 [0045.467] IUnknown:AddRef (This=0x28d2e0) returned 0x4 [0045.468] IUnknown:Release (This=0x28d2e0) returned 0x3 [0045.468] IUnknown:Release (This=0x28d2e0) returned 0x2 [0045.468] CoTaskMemFree (pv=0x91b020) [0045.468] CoGetContextToken (in: pToken=0x512e920 | out: pToken=0x512e920) returned 0x0 [0045.468] IUnknown:AddRef (This=0x28d2e0) returned 0x3 [0045.469] IWbemClassObject:Get (in: This=0x28d2e0, wszName="__GENUS", lFlags=0, pVal=0x512ec30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x512ecb0*=0, plFlavor=0x512ecac*=0 | out: pVal=0x512ec30*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x512ecb0*=3, plFlavor=0x512ecac*=64) returned 0x0 [0045.469] IWbemClassObject:Get (in: This=0x28d2e0, wszName="__PATH", lFlags=0, pVal=0x512ec14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x512ec98*=0, plFlavor=0x512ec94*=0 | out: pVal=0x512ec14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\cimv2:Win32_VideoController.DeviceID=\"VideoController1\"", varVal2=0x0), pType=0x512ec98*=8, plFlavor=0x512ec94*=64) returned 0x0 [0045.469] SysStringByteLen (bstr="\\\\XDUWTFONO\\ROOT\\cimv2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x90 [0045.469] SysStringByteLen (bstr="\\\\XDUWTFONO\\ROOT\\cimv2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x90 [0045.470] CoGetObjectContext (in: riid=0x258858c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x512ec40 | out: ppv=0x512ec40*=0x8dcca4) returned 0x0 [0045.470] IComThreadingInfo:GetCurrentApartmentType (in: This=0x8dcca4, pAptType=0x512ec38 | out: pAptType=0x512ec38*=1) returned 0x0 [0045.470] IUnknown:QueryInterface (in: This=0x8dcca4, riid=0x2588574*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x512ec3c | out: ppvObject=0x512ec3c*=0x0) returned 0x80004002 [0045.470] IUnknown:Release (This=0x8dcca4) returned 0x1 [0045.471] CoGetClassObject (in: rclsid=0x8ca3a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x73fad1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x512e5a8 | out: ppv=0x512e5a8*=0x280a10) returned 0x0 [0045.471] WbemDefPath:IUnknown:QueryInterface (in: This=0x280a10, riid=0x73fe0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x512e7c0 | out: ppvObject=0x512e7c0*=0x0) returned 0x80004002 [0045.471] WbemDefPath:IClassFactory:CreateInstance (in: This=0x280a10, pUnkOuter=0x0, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512e7d4 | out: ppvObject=0x512e7d4*=0x293050) returned 0x0 [0045.471] WbemDefPath:IUnknown:Release (This=0x280a10) returned 0x0 [0045.471] WbemDefPath:IUnknown:QueryInterface (in: This=0x293050, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512e3f4 | out: ppvObject=0x512e3f4*=0x293050) returned 0x0 [0045.471] WbemDefPath:IUnknown:QueryInterface (in: This=0x293050, riid=0x7404fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x512e3b0 | out: ppvObject=0x512e3b0*=0x0) returned 0x80004002 [0045.471] WbemDefPath:IUnknown:AddRef (This=0x293050) returned 0x3 [0045.471] WbemDefPath:IUnknown:QueryInterface (in: This=0x293050, riid=0x7404f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x512dd0c | out: ppvObject=0x512dd0c*=0x0) returned 0x80004002 [0045.471] WbemDefPath:IUnknown:QueryInterface (in: This=0x293050, riid=0x7404f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x512dcbc | out: ppvObject=0x512dcbc*=0x0) returned 0x80004002 [0045.471] WbemDefPath:IUnknown:QueryInterface (in: This=0x293050, riid=0x7403c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512dcc8 | out: ppvObject=0x512dcc8*=0x91b020) returned 0x0 [0045.471] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x91b020, riid=0x73f1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x512dcd0 | out: pCid=0x512dcd0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0045.471] WbemDefPath:IUnknown:Release (This=0x91b020) returned 0x3 [0045.471] CoGetContextToken (in: pToken=0x512dd28 | out: pToken=0x512dd28) returned 0x0 [0045.471] CoGetContextToken (in: pToken=0x512e130 | out: pToken=0x512e130) returned 0x0 [0045.471] WbemDefPath:IUnknown:QueryInterface (in: This=0x293050, riid=0x7404fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512e1c0 | out: ppvObject=0x512e1c0*=0x0) returned 0x80004002 [0045.471] WbemDefPath:IUnknown:Release (This=0x293050) returned 0x2 [0045.471] WbemDefPath:IUnknown:Release (This=0x293050) returned 0x1 [0045.471] CoGetContextToken (in: pToken=0x512eab8 | out: pToken=0x512eab8) returned 0x0 [0045.471] CoGetContextToken (in: pToken=0x512ea18 | out: pToken=0x512ea18) returned 0x0 [0045.472] WbemDefPath:IUnknown:QueryInterface (in: This=0x293050, riid=0x512eae8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x512eae4 | out: ppvObject=0x512eae4*=0x293050) returned 0x0 [0045.472] WbemDefPath:IUnknown:AddRef (This=0x293050) returned 0x3 [0045.472] WbemDefPath:IUnknown:Release (This=0x293050) returned 0x2 [0045.472] WbemDefPath:IWbemPath:SetText (This=0x293050, uMode=0x4, pszPath="\\\\XDUWTFONO\\ROOT\\cimv2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x0 [0045.472] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x280820, puCount=0x512ec6c | out: puCount=0x512ec6c*=0x2) returned 0x0 [0045.472] WbemDefPath:IWbemPath:GetText (in: This=0x280820, lFlags=4, puBuffLength=0x512ec68*=0x0, pszText=0x0 | out: puBuffLength=0x512ec68*=0xf, pszText=0x0) returned 0x0 [0045.472] WbemDefPath:IWbemPath:GetText (in: This=0x280820, lFlags=4, puBuffLength=0x512ec68*=0xf, pszText="00000000000000" | out: puBuffLength=0x512ec68*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0 [0045.474] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x280820, puCount=0x512ec34 | out: puCount=0x512ec34*=0x2) returned 0x0 [0045.474] WbemDefPath:IWbemPath:GetText (in: This=0x280820, lFlags=4, puBuffLength=0x512ec30*=0x0, pszText=0x0 | out: puBuffLength=0x512ec30*=0xf, pszText=0x0) returned 0x0 [0045.474] WbemDefPath:IWbemPath:GetText (in: This=0x280820, lFlags=4, puBuffLength=0x512ec30*=0xf, pszText="00000000000000" | out: puBuffLength=0x512ec30*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0 [0045.474] IWbemClassObject:Get (in: This=0x28d2e0, wszName="Description", lFlags=0, pVal=0x512ec30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x258e328*=0, plFlavor=0x258e32c*=0 | out: pVal=0x512ec30*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x258e328*=8, plFlavor=0x258e32c*=0) returned 0x0 [0045.474] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0045.474] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0045.474] IWbemClassObject:Get (in: This=0x28d2e0, wszName="Description", lFlags=0, pVal=0x512ec38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x258e328*=8, plFlavor=0x258e32c*=0 | out: pVal=0x512ec38*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x258e328*=8, plFlavor=0x258e32c*=0) returned 0x0 [0045.474] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0045.474] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0045.477] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x280820, puCount=0x512ec34 | out: puCount=0x512ec34*=0x2) returned 0x0 [0045.477] WbemDefPath:IWbemPath:GetText (in: This=0x280820, lFlags=4, puBuffLength=0x512ec30*=0x0, pszText=0x0 | out: puBuffLength=0x512ec30*=0xf, pszText=0x0) returned 0x0 [0045.477] WbemDefPath:IWbemPath:GetText (in: This=0x280820, lFlags=4, puBuffLength=0x512ec30*=0xf, pszText="00000000000000" | out: puBuffLength=0x512ec30*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0 [0045.477] IWbemClassObject:Get (in: This=0x28d2e0, wszName="Description", lFlags=0, pVal=0x512ec30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x258e470*=0, plFlavor=0x258e474*=0 | out: pVal=0x512ec30*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x258e470*=8, plFlavor=0x258e474*=0) returned 0x0 [0045.477] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0045.477] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0045.477] IWbemClassObject:Get (in: This=0x28d2e0, wszName="Description", lFlags=0, pVal=0x512ec38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x258e470*=8, plFlavor=0x258e474*=0 | out: pVal=0x512ec38*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x258e470*=8, plFlavor=0x258e474*=0) returned 0x0 [0045.477] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0045.477] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0045.477] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x280820, puCount=0x512ec34 | out: puCount=0x512ec34*=0x2) returned 0x0 [0045.477] WbemDefPath:IWbemPath:GetText (in: This=0x280820, lFlags=4, puBuffLength=0x512ec30*=0x0, pszText=0x0 | out: puBuffLength=0x512ec30*=0xf, pszText=0x0) returned 0x0 [0045.477] WbemDefPath:IWbemPath:GetText (in: This=0x280820, lFlags=4, puBuffLength=0x512ec30*=0xf, pszText="00000000000000" | out: puBuffLength=0x512ec30*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0 [0045.477] IWbemClassObject:Get (in: This=0x28d2e0, wszName="Description", lFlags=0, pVal=0x512ec30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x258e5a0*=0, plFlavor=0x258e5a4*=0 | out: pVal=0x512ec30*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x258e5a0*=8, plFlavor=0x258e5a4*=0) returned 0x0 [0045.477] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0045.477] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0045.477] IWbemClassObject:Get (in: This=0x28d2e0, wszName="Description", lFlags=0, pVal=0x512ec38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x258e5a0*=8, plFlavor=0x258e5a4*=0 | out: pVal=0x512ec38*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x258e5a0*=8, plFlavor=0x258e5a4*=0) returned 0x0 [0045.477] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0045.477] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0045.478] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x280820, puCount=0x512ec34 | out: puCount=0x512ec34*=0x2) returned 0x0 [0045.478] WbemDefPath:IWbemPath:GetText (in: This=0x280820, lFlags=4, puBuffLength=0x512ec30*=0x0, pszText=0x0 | out: puBuffLength=0x512ec30*=0xf, pszText=0x0) returned 0x0 [0045.478] WbemDefPath:IWbemPath:GetText (in: This=0x280820, lFlags=4, puBuffLength=0x512ec30*=0xf, pszText="00000000000000" | out: puBuffLength=0x512ec30*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0 [0045.478] IWbemClassObject:Get (in: This=0x28d2e0, wszName="Description", lFlags=0, pVal=0x512ec30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x258e6ec*=0, plFlavor=0x258e6f0*=0 | out: pVal=0x512ec30*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x258e6ec*=8, plFlavor=0x258e6f0*=0) returned 0x0 [0045.478] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0045.478] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0045.478] IWbemClassObject:Get (in: This=0x28d2e0, wszName="Description", lFlags=0, pVal=0x512ec38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x258e6ec*=8, plFlavor=0x258e6f0*=0 | out: pVal=0x512ec38*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x258e6ec*=8, plFlavor=0x258e6f0*=0) returned 0x0 [0045.478] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0045.478] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0045.478] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x280820, puCount=0x512ec34 | out: puCount=0x512ec34*=0x2) returned 0x0 [0045.478] WbemDefPath:IWbemPath:GetText (in: This=0x280820, lFlags=4, puBuffLength=0x512ec30*=0x0, pszText=0x0 | out: puBuffLength=0x512ec30*=0xf, pszText=0x0) returned 0x0 [0045.478] WbemDefPath:IWbemPath:GetText (in: This=0x280820, lFlags=4, puBuffLength=0x512ec30*=0xf, pszText="00000000000000" | out: puBuffLength=0x512ec30*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0 [0045.478] IWbemClassObject:Get (in: This=0x28d2e0, wszName="Description", lFlags=0, pVal=0x512ec30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x258e820*=0, plFlavor=0x258e824*=0 | out: pVal=0x512ec30*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x258e820*=8, plFlavor=0x258e824*=0) returned 0x0 [0045.478] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0045.478] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0045.478] IWbemClassObject:Get (in: This=0x28d2e0, wszName="Description", lFlags=0, pVal=0x512ec38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x258e820*=8, plFlavor=0x258e824*=0 | out: pVal=0x512ec38*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x258e820*=8, plFlavor=0x258e824*=0) returned 0x0 [0045.478] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0045.478] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0045.479] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x280820, puCount=0x512ec34 | out: puCount=0x512ec34*=0x2) returned 0x0 [0045.479] WbemDefPath:IWbemPath:GetText (in: This=0x280820, lFlags=4, puBuffLength=0x512ec30*=0x0, pszText=0x0 | out: puBuffLength=0x512ec30*=0xf, pszText=0x0) returned 0x0 [0045.479] WbemDefPath:IWbemPath:GetText (in: This=0x280820, lFlags=4, puBuffLength=0x512ec30*=0xf, pszText="00000000000000" | out: puBuffLength=0x512ec30*=0xf, pszText="\\\\.\\ROOT\\cimv2") returned 0x0 [0045.479] IWbemClassObject:Get (in: This=0x28d2e0, wszName="Description", lFlags=0, pVal=0x512ec30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x258e98c*=0, plFlavor=0x258e990*=0 | out: pVal=0x512ec30*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x258e98c*=8, plFlavor=0x258e990*=0) returned 0x0 [0045.479] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0045.479] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0045.479] IWbemClassObject:Get (in: This=0x28d2e0, wszName="Description", lFlags=0, pVal=0x512ec38*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x258e98c*=8, plFlavor=0x258e990*=0 | out: pVal=0x512ec38*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x258e98c*=8, plFlavor=0x258e990*=0) returned 0x0 [0045.479] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0045.479] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0045.479] CoTaskMemAlloc (cb=0x4) returned 0x91b060 [0045.479] IEnumWbemClassObject:Next (in: This=0x28d2a4, lTimeout=-1, uCount=0x1, apObjects=0x91b060, puReturned=0x258da38 | out: apObjects=0x91b060*=0x0, puReturned=0x258da38*=0x0) returned 0x1 [0045.481] CoTaskMemFree (pv=0x91b060) [0045.481] CoGetContextToken (in: pToken=0x512eb68 | out: pToken=0x512eb68) returned 0x0 [0045.481] WbemLocator:IUnknown:Release (This=0x91e5a4) returned 0x1 [0045.482] IUnknown:Release (This=0x28d2a4) returned 0x0 [0045.482] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\regedit.exe", nBufferLength=0x105, lpBuffer=0x512e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\regedit.exe", lpFilePart=0x0) returned 0x3c [0045.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x512ee08) returned 1 [0045.482] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\regedit.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\regedit.exe"), fInfoLevelId=0x0, lpFileInformation=0x512ee84 | out: lpFileInformation=0x512ee84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0045.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x512ee04) returned 1 [0045.483] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe", nBufferLength=0x105, lpBuffer=0x512e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe", lpFilePart=0x0) returned 0x38 [0045.483] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\regedit.exe", nBufferLength=0x105, lpBuffer=0x512e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\regedit.exe", lpFilePart=0x0) returned 0x3c [0045.483] CopyFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\regasm.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\regedit.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\regedit.exe"), bFailIfExists=1) returned 1 [0045.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\\\regedit.exe:Zone.Identifier", cchWideChar=77, lpMultiByteStr=0x512ee20, cbMultiByte=79, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\\\regedit.exe:Zone.Identifier*\x1d", lpUsedDefaultChar=0x0) returned 77 [0045.501] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\\\regedit.exe:Zone.Identifier" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\regedit.exe:zone.identifier")) returned 0 [0045.511] CoTaskMemAlloc (cb=0x20c) returned 0x9429e8 [0045.511] SHGetFolderPathW (in: hwnd=0x0, csidl=36, hToken=0x0, dwFlags=0x0, pszPath=0x9429e8 | out: pszPath="C:\\Windows") returned 0x0 [0045.512] CoTaskMemFree (pv=0x9429e8) [0045.512] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x512e90c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0045.513] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe", nBufferLength=0x105, lpBuffer=0x512e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe", lpFilePart=0x0) returned 0x35 [0045.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x512ee08) returned 1 [0045.513] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\vbc.exe"), fInfoLevelId=0x0, lpFileInformation=0x512ee84 | out: lpFileInformation=0x512ee84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bc7dbfe, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bc7dbfe, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bca3d5e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11d748)) returned 1 [0045.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x512ee04) returned 1 [0045.518] SleepEx (dwMilliseconds=0x3a980, bAlertable=1) returned 0x0 [0060.068] VirtualAlloc (lpAddress=0x0, dwSize=0x2205, flAllocationType=0x3000, flProtect=0x40) returned 0x260000 [0060.078] CoTaskMemAlloc (cb=0x20c) returned 0x940b38 [0060.078] SHGetFolderPathW (in: hwnd=0x0, csidl=36, hToken=0x0, dwFlags=0x0, pszPath=0x940b38 | out: pszPath="C:\\Windows") returned 0x0 [0060.078] CoTaskMemFree (pv=0x940b38) [0060.079] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x512e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0060.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe", cchWideChar=53, lpMultiByteStr=0x512edc8, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe9\x1d", lpUsedDefaultChar=0x0) returned 53 [0060.079] strlen (_Str="kernel32.dll") returned 0xc [0060.079] mbstowcs (in: _Dest=0x512ca90, _Source="kernel32.dll", _MaxCount=0xd | out: _Dest="kernel32.dll") returned 0xc [0060.079] strlen (_Str="KERNEL32.DLL") returned 0xc [0060.079] mbstowcs (in: _Dest=0x512c888, _Source="KERNEL32.DLL", _MaxCount=0xd | out: _Dest="KERNEL32.DLL") returned 0xc [0060.079] strlen (_Str="\\KnownDlls32\\ntdll.dll") returned 0x16 [0060.079] mbstowcs (in: _Dest=0x512cc98, _Source="\\KnownDlls32\\ntdll.dll", _MaxCount=0x17 | out: _Dest="\\KnownDlls32\\ntdll.dll") returned 0x16 [0060.079] strlen (_Str="\\KnownDlls32\\advapi32.dll") returned 0x19 [0060.079] mbstowcs (in: _Dest=0x512cea0, _Source="\\KnownDlls32\\advapi32.dll", _MaxCount=0x1a | out: _Dest="\\KnownDlls32\\advapi32.dll") returned 0x19 [0060.079] strlen (_Str="\\KnownDlls32\\kernel32.dll") returned 0x19 [0060.079] mbstowcs (in: _Dest=0x512dee0, _Source="\\KnownDlls32\\kernel32.dll", _MaxCount=0x1a | out: _Dest="\\KnownDlls32\\kernel32.dll") returned 0x19 [0060.079] strlen (_Str="\\KnownDlls32\\user32.dll") returned 0x17 [0060.079] mbstowcs (in: _Dest=0x512dcd8, _Source="\\KnownDlls32\\user32.dll", _MaxCount=0x18 | out: _Dest="\\KnownDlls32\\user32.dll") returned 0x17 [0060.079] strlen (_Str="\\KnownDlls32\\Ole32.dll") returned 0x16 [0060.079] mbstowcs (in: _Dest=0x512d4b8, _Source="\\KnownDlls32\\Ole32.dll", _MaxCount=0x17 | out: _Dest="\\KnownDlls32\\Ole32.dll") returned 0x16 [0060.079] strlen (_Str="\\KnownDlls\\ntdll.dll") returned 0x14 [0060.079] mbstowcs (in: _Dest=0x512d6c0, _Source="\\KnownDlls\\ntdll.dll", _MaxCount=0x15 | out: _Dest="\\KnownDlls\\ntdll.dll") returned 0x14 [0060.079] strlen (_Str="\\KnownDlls\\advapi32.dll") returned 0x17 [0060.079] mbstowcs (in: _Dest=0x512dad0, _Source="\\KnownDlls\\advapi32.dll", _MaxCount=0x18 | out: _Dest="\\KnownDlls\\advapi32.dll") returned 0x17 [0060.079] strlen (_Str="\\KnownDlls\\kernel32.dll") returned 0x17 [0060.079] mbstowcs (in: _Dest=0x512d2b0, _Source="\\KnownDlls\\kernel32.dll", _MaxCount=0x18 | out: _Dest="\\KnownDlls\\kernel32.dll") returned 0x17 [0060.079] strlen (_Str="\\KnownDlls\\user32.dll") returned 0x15 [0060.079] mbstowcs (in: _Dest=0x512d8c8, _Source="\\KnownDlls\\user32.dll", _MaxCount=0x16 | out: _Dest="\\KnownDlls\\user32.dll") returned 0x15 [0060.080] strlen (_Str="\\KnownDlls\\Ole32.dll") returned 0x14 [0060.080] mbstowcs (in: _Dest=0x512d0a8, _Source="\\KnownDlls\\Ole32.dll", _MaxCount=0x15 | out: _Dest="\\KnownDlls\\Ole32.dll") returned 0x14 [0060.080] wcslen (_String="\\KnownDlls32\\advapi32.dll") returned 0x19 [0060.080] NtOpenSection (in: SectionHandle=0x512c864, DesiredAccess=0xc, ObjectAttributes=0x512c814*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\advapi32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x512c864*=0x264) returned 0x0 [0060.080] NtMapViewOfSection (in: SectionHandle=0x264, ProcessHandle=0xffffffff, BaseAddress=0x512c86c*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x512c868*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x512c86c*=0x52e0000, SectionOffset=0x0, ViewSize=0x512c868*=0xa0000) returned 0x40000003 [0060.080] wcslen (_String="\\KnownDlls32\\ntdll.dll") returned 0x16 [0060.080] NtOpenSection (in: SectionHandle=0x512c864, DesiredAccess=0xc, ObjectAttributes=0x512c814*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\ntdll.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x512c864*=0x1f4) returned 0x0 [0060.080] NtMapViewOfSection (in: SectionHandle=0x1f4, ProcessHandle=0xffffffff, BaseAddress=0x512c86c*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x512c868*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x512c86c*=0x5380000, SectionOffset=0x0, ViewSize=0x512c868*=0x180000) returned 0x40000003 [0060.080] wcslen (_String="\\KnownDlls32\\kernel32.dll") returned 0x19 [0060.080] NtOpenSection (in: SectionHandle=0x512c864, DesiredAccess=0xc, ObjectAttributes=0x512c814*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\kernel32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x512c864*=0x1e4) returned 0x0 [0060.080] NtMapViewOfSection (in: SectionHandle=0x1e4, ProcessHandle=0xffffffff, BaseAddress=0x512c86c*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x512c868*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x512c86c*=0x5500000, SectionOffset=0x0, ViewSize=0x512c868*=0x110000) returned 0x40000003 [0060.081] wcslen (_String="\\KnownDlls32\\user32.dll") returned 0x17 [0060.081] NtOpenSection (in: SectionHandle=0x512c864, DesiredAccess=0xc, ObjectAttributes=0x512c814*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\user32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x512c864*=0x1f8) returned 0x0 [0060.081] NtMapViewOfSection (in: SectionHandle=0x1f8, ProcessHandle=0xffffffff, BaseAddress=0x512c86c*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x512c868*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x512c86c*=0x5610000, SectionOffset=0x0, ViewSize=0x512c868*=0x100000) returned 0x40000003 [0060.081] wcslen (_String="\\KnownDlls32\\Ole32.dll") returned 0x16 [0060.081] NtOpenSection (in: SectionHandle=0x512c864, DesiredAccess=0xc, ObjectAttributes=0x512c814*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\Ole32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x512c864*=0x1e8) returned 0x0 [0060.081] NtMapViewOfSection (in: SectionHandle=0x1e8, ProcessHandle=0xffffffff, BaseAddress=0x512c86c*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x512c868*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x512c86c*=0x5710000, SectionOffset=0x0, ViewSize=0x512c868*=0x15c000) returned 0x40000003 [0060.082] LoadLibraryA (lpLibFileName="Ole32.dll") returned 0x755e0000 [0060.083] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0060.083] GetProcAddress (hModule=0x74d40000, lpProcName="CryptAcquireContextW") returned 0x74d4df14 [0060.083] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0060.083] GetProcAddress (hModule=0x74d40000, lpProcName="CryptCreateHash") returned 0x74d4df4e [0060.083] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0060.083] GetProcAddress (hModule=0x74d40000, lpProcName="CryptDecrypt") returned 0x74d83178 [0060.083] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0060.084] GetProcAddress (hModule=0x74d40000, lpProcName="CryptDeriveKey") returned 0x74d83188 [0060.084] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0060.084] GetProcAddress (hModule=0x74d40000, lpProcName="CryptDestroyHash") returned 0x74d4df66 [0060.084] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0060.084] GetProcAddress (hModule=0x74d40000, lpProcName="CryptDestroyKey") returned 0x74d4c51a [0060.084] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0060.085] GetProcAddress (hModule=0x74d40000, lpProcName="CryptHashData") returned 0x74d4df36 [0060.085] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0060.085] GetProcAddress (hModule=0x74d40000, lpProcName="CryptReleaseContext") returned 0x74d4e124 [0060.086] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0060.087] GetProcAddress (hModule=0x74f40000, lpProcName="MessageBoxA") returned 0x74fafd1e [0060.087] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0060.087] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0060.087] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0060.087] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0060.088] GetProcAddress (hModule=0x755e0000, lpProcName="CoInitializeEx") returned 0x756209ad [0060.088] GetProcAddress (hModule=0x755e0000, lpProcName="CoCreateInstance") returned 0x75629d0b [0060.088] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0060.088] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexW") returned 0x76c3424c [0060.088] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="frenchy_shellcode_003") returned 0x1ec [0060.088] strlen (_Str="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe") returned 0x35 [0060.088] strlen (_Str="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe") returned 0x35 [0060.088] mbstowcs (in: _Dest=0x512e188, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe", _MaxCount=0x36 | out: _Dest="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe") returned 0x35 [0060.089] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe", lpDst=0x512e660, nSize=0x104 | out: lpDst="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe") returned 0x36 [0060.089] CreateProcessW (in: lpApplicationName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x800000c, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x512e768*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x512e7e8 | out: lpCommandLine=0x0, lpProcessInformation=0x512e7e8*(hProcess=0x32c, hThread=0x328, dwProcessId=0x8c4, dwThreadId=0x40c)) returned 1 [0060.318] NtQueryInformationProcess (in: ProcessHandle=0x32c, ProcessInformationClass=0x0, ProcessInformation=0x512e7b4, ProcessInformationLength=0x18, ReturnLength=0x0 | out: ProcessInformation=0x512e7b4, ReturnLength=0x0) returned 0x0 [0060.318] NtReadVirtualMemory (in: ProcessHandle=0x32c, BaseAddress=0x7efde008, Buffer=0x512e808, NumberOfBytesToRead=0x4, NumberOfBytesRead=0x0 | out: Buffer=0x512e808*, NumberOfBytesRead=0x0) returned 0x0 [0060.318] NtUnmapViewOfSection (ProcessHandle=0x32c, BaseAddress=0x400000) returned 0x0 [0060.319] NtCreateSection (in: SectionHandle=0x512e7e0, DesiredAccess=0xf001f, ObjectAttributes=0x0, MaximumSize=0x512e7d0, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x512e7e0*=0x334) returned 0x0 [0060.319] NtMapViewOfSection (in: SectionHandle=0x334, ProcessHandle=0xffffffff, BaseAddress=0x512e7fc*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x512e7d8*=0x67000, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x512e7fc*=0x4fc0000, SectionOffset=0x0, ViewSize=0x512e7d8*=0x67000) returned 0x0 [0060.319] NtMapViewOfSection (in: SectionHandle=0x334, ProcessHandle=0x32c, BaseAddress=0x512e7f8*=0x400000, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x512e7dc*=0x67000, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x512e7f8*=0x400000, SectionOffset=0x0, ViewSize=0x512e7dc*=0x67000) returned 0x0 [0060.323] NtWriteVirtualMemory (in: ProcessHandle=0x32c, BaseAddress=0x7efde008, Buffer=0x512e7f8*, NumberOfBytesToWrite=0x4, NumberOfBytesWritten=0x512e7cc | out: Buffer=0x512e7f8*, NumberOfBytesWritten=0x512e7cc*=0x4) returned 0x0 [0060.323] NtGetContextThread (in: ThreadHandle=0x328, Context=0x512e390 | out: Context=0x512e390*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x4748da, Ebp=0x0, Eip=0x771401c4, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0060.323] NtSetContextThread (ThreadHandle=0x328, Context=0x512e390*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x40ef30, Ebp=0x0, Eip=0x771401c4, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0060.324] NtResumeThread (in: ThreadHandle=0x328, SuspendCount=0x0 | out: SuspendCount=0x0) returned 0x0 [0060.326] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe", nBufferLength=0x105, lpBuffer=0x512e924, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe", lpFilePart=0x0) returned 0x38 [0060.335] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x937738 [0060.335] LocalAlloc (uFlags=0x0, uBytes=0xba) returned 0x8f3e28 [0060.668] LocalFree (hMem=0x937738) returned 0x0 [0060.668] LocalFree (hMem=0x8f3e28) returned 0x0 [0060.689] GetCurrentProcess () returned 0xffffffff [0060.698] GetKernelObjectSecurity (in: Handle=0xffffffff, RequestedInformation=0x4, pSecurityDescriptor=0x260b0bc, nLength=0x0, lpnLengthNeeded=0x512eea4 | out: pSecurityDescriptor=0x260b0bc, lpnLengthNeeded=0x512eea4) returned 0 [0060.698] GetKernelObjectSecurity (in: Handle=0xffffffff, RequestedInformation=0x4, pSecurityDescriptor=0x260b118, nLength=0x64, lpnLengthNeeded=0x512eea4 | out: pSecurityDescriptor=0x260b118, lpnLengthNeeded=0x512eea4) returned 1 [0060.743] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x512e714 | out: lpLuid=0x512e714*(LowPart=0x14, HighPart=0)) returned 1 [0060.744] GetCurrentProcess () returned 0xffffffff [0060.744] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x512e710 | out: TokenHandle=0x512e710*=0x470) returned 1 [0060.744] AdjustTokenPrivileges (in: TokenHandle=0x470, DisableAllPrivileges=0, NewState=0x260b3cc*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0060.744] CloseHandle (hObject=0x470) returned 1 [0060.750] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512edf0 | out: SystemInformation=0x3663cf0, ResultLength=0x512edf0*=0xa8f8) returned 0x0 [0060.768] GetCurrentProcessId () returned 0xb14 [0060.769] GetCurrentProcessId () returned 0xb14 [0060.770] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.772] GetCurrentProcessId () returned 0xb14 [0060.772] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.773] GetCurrentProcessId () returned 0xb14 [0060.773] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.773] GetCurrentProcessId () returned 0xb14 [0060.773] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.774] GetCurrentProcessId () returned 0xb14 [0060.774] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.774] GetCurrentProcessId () returned 0xb14 [0060.774] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.774] GetCurrentProcessId () returned 0xb14 [0060.774] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.774] GetCurrentProcessId () returned 0xb14 [0060.774] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.775] GetCurrentProcessId () returned 0xb14 [0060.775] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.778] GetCurrentProcessId () returned 0xb14 [0060.778] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.785] OpenThread (dwDesiredAccess=0x1f03ff, bInheritHandle=0, dwThreadId=0xb18) returned 0x470 [0060.785] GetKernelObjectSecurity (in: Handle=0x470, RequestedInformation=0x4, pSecurityDescriptor=0x26f2588, nLength=0x0, lpnLengthNeeded=0x512ee38 | out: pSecurityDescriptor=0x26f2588, lpnLengthNeeded=0x512ee38) returned 0 [0060.785] GetKernelObjectSecurity (in: Handle=0x470, RequestedInformation=0x4, pSecurityDescriptor=0x26f25e4, nLength=0x64, lpnLengthNeeded=0x512ee38 | out: pSecurityDescriptor=0x26f25e4, lpnLengthNeeded=0x512ee38) returned 1 [0060.810] SetKernelObjectSecurity (Handle=0x470, SecurityInformation=0x4, SecurityDescriptor=0x26f288c) returned 1 [0060.811] GetCurrentProcessId () returned 0xb14 [0060.811] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.815] OpenThread (dwDesiredAccess=0x1f03ff, bInheritHandle=0, dwThreadId=0xb1c) returned 0x348 [0060.816] GetKernelObjectSecurity (in: Handle=0x348, RequestedInformation=0x4, pSecurityDescriptor=0x27074b8, nLength=0x0, lpnLengthNeeded=0x512ee38 | out: pSecurityDescriptor=0x27074b8, lpnLengthNeeded=0x512ee38) returned 0 [0060.816] GetKernelObjectSecurity (in: Handle=0x348, RequestedInformation=0x4, pSecurityDescriptor=0x2707514, nLength=0x64, lpnLengthNeeded=0x512ee38 | out: pSecurityDescriptor=0x2707514, lpnLengthNeeded=0x512ee38) returned 1 [0060.816] SetKernelObjectSecurity (Handle=0x348, SecurityInformation=0x4, SecurityDescriptor=0x27077bc) returned 1 [0060.816] GetCurrentProcessId () returned 0xb14 [0060.816] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.816] OpenThread (dwDesiredAccess=0x1f03ff, bInheritHandle=0, dwThreadId=0xb20) returned 0x444 [0060.817] GetKernelObjectSecurity (in: Handle=0x444, RequestedInformation=0x4, pSecurityDescriptor=0x271c3e8, nLength=0x0, lpnLengthNeeded=0x512ee38 | out: pSecurityDescriptor=0x271c3e8, lpnLengthNeeded=0x512ee38) returned 0 [0060.817] GetKernelObjectSecurity (in: Handle=0x444, RequestedInformation=0x4, pSecurityDescriptor=0x271c444, nLength=0x64, lpnLengthNeeded=0x512ee38 | out: pSecurityDescriptor=0x271c444, lpnLengthNeeded=0x512ee38) returned 1 [0060.817] SetKernelObjectSecurity (Handle=0x444, SecurityInformation=0x4, SecurityDescriptor=0x271c6ec) returned 1 [0060.817] GetCurrentProcessId () returned 0xb14 [0060.817] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.817] OpenThread (dwDesiredAccess=0x1f03ff, bInheritHandle=0, dwThreadId=0xb24) returned 0x440 [0060.817] GetKernelObjectSecurity (in: Handle=0x440, RequestedInformation=0x4, pSecurityDescriptor=0x2731318, nLength=0x0, lpnLengthNeeded=0x512ee38 | out: pSecurityDescriptor=0x2731318, lpnLengthNeeded=0x512ee38) returned 0 [0060.817] GetKernelObjectSecurity (in: Handle=0x440, RequestedInformation=0x4, pSecurityDescriptor=0x2731374, nLength=0x64, lpnLengthNeeded=0x512ee38 | out: pSecurityDescriptor=0x2731374, lpnLengthNeeded=0x512ee38) returned 1 [0060.818] SetKernelObjectSecurity (Handle=0x440, SecurityInformation=0x4, SecurityDescriptor=0x273161c) returned 1 [0060.818] GetCurrentProcessId () returned 0xb14 [0060.818] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.818] OpenThread (dwDesiredAccess=0x1f03ff, bInheritHandle=0, dwThreadId=0xb28) returned 0x41c [0060.818] GetKernelObjectSecurity (in: Handle=0x41c, RequestedInformation=0x4, pSecurityDescriptor=0x2746248, nLength=0x0, lpnLengthNeeded=0x512ee38 | out: pSecurityDescriptor=0x2746248, lpnLengthNeeded=0x512ee38) returned 0 [0060.818] GetKernelObjectSecurity (in: Handle=0x41c, RequestedInformation=0x4, pSecurityDescriptor=0x27462a4, nLength=0x64, lpnLengthNeeded=0x512ee38 | out: pSecurityDescriptor=0x27462a4, lpnLengthNeeded=0x512ee38) returned 1 [0060.819] SetKernelObjectSecurity (Handle=0x41c, SecurityInformation=0x4, SecurityDescriptor=0x274654c) returned 1 [0060.819] GetCurrentProcessId () returned 0xb14 [0060.819] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.819] OpenThread (dwDesiredAccess=0x1f03ff, bInheritHandle=0, dwThreadId=0xb2c) returned 0x418 [0060.819] GetKernelObjectSecurity (in: Handle=0x418, RequestedInformation=0x4, pSecurityDescriptor=0x275b178, nLength=0x0, lpnLengthNeeded=0x512ee38 | out: pSecurityDescriptor=0x275b178, lpnLengthNeeded=0x512ee38) returned 0 [0060.819] GetKernelObjectSecurity (in: Handle=0x418, RequestedInformation=0x4, pSecurityDescriptor=0x275b1d4, nLength=0x64, lpnLengthNeeded=0x512ee38 | out: pSecurityDescriptor=0x275b1d4, lpnLengthNeeded=0x512ee38) returned 1 [0060.819] SetKernelObjectSecurity (Handle=0x418, SecurityInformation=0x4, SecurityDescriptor=0x275b47c) returned 1 [0060.819] GetCurrentProcessId () returned 0xb14 [0060.819] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.820] OpenThread (dwDesiredAccess=0x1f03ff, bInheritHandle=0, dwThreadId=0xb30) returned 0x410 [0060.820] GetKernelObjectSecurity (in: Handle=0x410, RequestedInformation=0x4, pSecurityDescriptor=0x27700a8, nLength=0x0, lpnLengthNeeded=0x512ee38 | out: pSecurityDescriptor=0x27700a8, lpnLengthNeeded=0x512ee38) returned 0 [0060.820] GetKernelObjectSecurity (in: Handle=0x410, RequestedInformation=0x4, pSecurityDescriptor=0x2770104, nLength=0x64, lpnLengthNeeded=0x512ee38 | out: pSecurityDescriptor=0x2770104, lpnLengthNeeded=0x512ee38) returned 1 [0060.820] SetKernelObjectSecurity (Handle=0x410, SecurityInformation=0x4, SecurityDescriptor=0x27703ac) returned 1 [0060.820] GetCurrentProcessId () returned 0xb14 [0060.820] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.820] OpenThread (dwDesiredAccess=0x1f03ff, bInheritHandle=0, dwThreadId=0xb34) returned 0x420 [0060.821] GetKernelObjectSecurity (in: Handle=0x420, RequestedInformation=0x4, pSecurityDescriptor=0x2784fd8, nLength=0x0, lpnLengthNeeded=0x512ee38 | out: pSecurityDescriptor=0x2784fd8, lpnLengthNeeded=0x512ee38) returned 0 [0060.821] GetKernelObjectSecurity (in: Handle=0x420, RequestedInformation=0x4, pSecurityDescriptor=0x2785034, nLength=0x64, lpnLengthNeeded=0x512ee38 | out: pSecurityDescriptor=0x2785034, lpnLengthNeeded=0x512ee38) returned 1 [0060.821] SetKernelObjectSecurity (Handle=0x420, SecurityInformation=0x4, SecurityDescriptor=0x27852dc) returned 1 [0060.821] GetCurrentProcessId () returned 0xb14 [0060.821] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.821] OpenThread (dwDesiredAccess=0x1f03ff, bInheritHandle=0, dwThreadId=0xb38) returned 0x428 [0060.821] GetKernelObjectSecurity (in: Handle=0x428, RequestedInformation=0x4, pSecurityDescriptor=0x2799f08, nLength=0x0, lpnLengthNeeded=0x512ee38 | out: pSecurityDescriptor=0x2799f08, lpnLengthNeeded=0x512ee38) returned 0 [0060.821] GetKernelObjectSecurity (in: Handle=0x428, RequestedInformation=0x4, pSecurityDescriptor=0x2799f64, nLength=0x64, lpnLengthNeeded=0x512ee38 | out: pSecurityDescriptor=0x2799f64, lpnLengthNeeded=0x512ee38) returned 1 [0060.822] SetKernelObjectSecurity (Handle=0x428, SecurityInformation=0x4, SecurityDescriptor=0x279a20c) returned 1 [0060.822] GetCurrentProcessId () returned 0xb14 [0060.822] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.822] OpenThread (dwDesiredAccess=0x1f03ff, bInheritHandle=0, dwThreadId=0xb3c) returned 0x46c [0060.822] GetKernelObjectSecurity (in: Handle=0x46c, RequestedInformation=0x4, pSecurityDescriptor=0x27aee38, nLength=0x0, lpnLengthNeeded=0x512ee38 | out: pSecurityDescriptor=0x27aee38, lpnLengthNeeded=0x512ee38) returned 0 [0060.822] GetKernelObjectSecurity (in: Handle=0x46c, RequestedInformation=0x4, pSecurityDescriptor=0x27aee94, nLength=0x64, lpnLengthNeeded=0x512ee38 | out: pSecurityDescriptor=0x27aee94, lpnLengthNeeded=0x512ee38) returned 1 [0060.822] SetKernelObjectSecurity (Handle=0x46c, SecurityInformation=0x4, SecurityDescriptor=0x27af13c) returned 1 [0060.823] GetCurrentProcessId () returned 0xb14 [0060.823] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.826] OpenThread (dwDesiredAccess=0x1f03ff, bInheritHandle=0, dwThreadId=0xb40) returned 0x474 [0060.826] GetKernelObjectSecurity (in: Handle=0x474, RequestedInformation=0x4, pSecurityDescriptor=0x25d99e4, nLength=0x0, lpnLengthNeeded=0x512ee38 | out: pSecurityDescriptor=0x25d99e4, lpnLengthNeeded=0x512ee38) returned 0 [0060.827] GetKernelObjectSecurity (in: Handle=0x474, RequestedInformation=0x4, pSecurityDescriptor=0x25d9a40, nLength=0x64, lpnLengthNeeded=0x512ee38 | out: pSecurityDescriptor=0x25d9a40, lpnLengthNeeded=0x512ee38) returned 1 [0060.827] SetKernelObjectSecurity (Handle=0x474, SecurityInformation=0x4, SecurityDescriptor=0x25d9ce8) returned 1 [0060.827] GetCurrentProcessId () returned 0xb14 [0060.827] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.827] OpenThread (dwDesiredAccess=0x1f03ff, bInheritHandle=0, dwThreadId=0x494) returned 0x43c [0060.827] GetKernelObjectSecurity (in: Handle=0x43c, RequestedInformation=0x4, pSecurityDescriptor=0x25ee914, nLength=0x0, lpnLengthNeeded=0x512ee38 | out: pSecurityDescriptor=0x25ee914, lpnLengthNeeded=0x512ee38) returned 0 [0060.827] GetKernelObjectSecurity (in: Handle=0x43c, RequestedInformation=0x4, pSecurityDescriptor=0x25ee970, nLength=0x64, lpnLengthNeeded=0x512ee38 | out: pSecurityDescriptor=0x25ee970, lpnLengthNeeded=0x512ee38) returned 1 [0060.828] SetKernelObjectSecurity (Handle=0x43c, SecurityInformation=0x4, SecurityDescriptor=0x25eec18) returned 1 [0060.828] GetCurrentProcessId () returned 0xb14 [0060.828] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.828] GetCurrentProcessId () returned 0xb14 [0060.828] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.828] GetCurrentProcessId () returned 0xb14 [0060.828] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.829] GetCurrentProcessId () returned 0xb14 [0060.829] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.829] GetCurrentProcessId () returned 0xb14 [0060.829] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.829] GetCurrentProcessId () returned 0xb14 [0060.829] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.830] GetCurrentProcessId () returned 0xb14 [0060.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.830] GetCurrentProcessId () returned 0xb14 [0060.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.830] GetCurrentProcessId () returned 0xb14 [0060.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.831] GetCurrentProcessId () returned 0xb14 [0060.831] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.831] GetCurrentProcessId () returned 0xb14 [0060.831] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.831] GetCurrentProcessId () returned 0xb14 [0060.831] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.832] GetCurrentProcessId () returned 0xb14 [0060.832] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.832] GetCurrentProcessId () returned 0xb14 [0060.832] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.832] GetCurrentProcessId () returned 0xb14 [0060.832] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.832] GetCurrentProcessId () returned 0xb14 [0060.832] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.833] GetCurrentProcessId () returned 0xb14 [0060.833] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.833] GetCurrentProcessId () returned 0xb14 [0060.833] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.833] GetCurrentProcessId () returned 0xb14 [0060.833] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.834] GetCurrentProcessId () returned 0xb14 [0060.834] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.834] GetCurrentProcessId () returned 0xb14 [0060.834] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.834] GetCurrentProcessId () returned 0xb14 [0060.834] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.834] GetCurrentProcessId () returned 0xb14 [0060.834] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.835] GetCurrentProcessId () returned 0xb14 [0060.835] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.838] GetCurrentProcessId () returned 0xb14 [0060.838] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.839] GetCurrentProcessId () returned 0xb14 [0060.839] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.839] GetCurrentProcessId () returned 0xb14 [0060.839] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.839] GetCurrentProcessId () returned 0xb14 [0060.839] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.839] GetCurrentProcessId () returned 0xb14 [0060.839] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.840] GetCurrentProcessId () returned 0xb14 [0060.840] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.840] GetCurrentProcessId () returned 0xb14 [0060.840] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.840] GetCurrentProcessId () returned 0xb14 [0060.840] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.841] GetCurrentProcessId () returned 0xb14 [0060.841] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.841] GetCurrentProcessId () returned 0xb14 [0060.841] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.841] GetCurrentProcessId () returned 0xb14 [0060.841] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.841] GetCurrentProcessId () returned 0xb14 [0060.842] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.842] GetCurrentProcessId () returned 0xb14 [0060.842] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.842] GetCurrentProcessId () returned 0xb14 [0060.842] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.842] GetCurrentProcessId () returned 0xb14 [0060.842] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.843] GetCurrentProcessId () returned 0xb14 [0060.843] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.843] GetCurrentProcessId () returned 0xb14 [0060.843] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.843] GetCurrentProcessId () returned 0xb14 [0060.843] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.844] GetCurrentProcessId () returned 0xb14 [0060.844] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.844] GetCurrentProcessId () returned 0xb14 [0060.844] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.850] GetCurrentProcessId () returned 0xb14 [0060.850] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.851] GetCurrentProcessId () returned 0xb14 [0060.851] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.851] GetCurrentProcessId () returned 0xb14 [0060.851] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.851] GetCurrentProcessId () returned 0xb14 [0060.851] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.851] GetCurrentProcessId () returned 0xb14 [0060.851] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ede0 | out: SystemInformation=0x3663cf0, ResultLength=0x512ede0*=0xa8f8) returned 0x0 [0060.855] SetKernelObjectSecurity (Handle=0xffffffff, SecurityInformation=0x4, SecurityDescriptor=0x25fbc44) returned 1 [0060.882] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee14 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee14*=0xa8f8) returned 0x0 [0060.887] GetCurrentProcessId () returned 0xb14 [0060.887] GetCurrentProcessId () returned 0xb14 [0060.887] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa8f8) returned 0x0 [0060.887] GetCurrentProcessId () returned 0xb14 [0060.887] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa8f8) returned 0x0 [0060.887] GetCurrentProcessId () returned 0xb14 [0060.887] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa8f8) returned 0x0 [0060.888] GetCurrentProcessId () returned 0xb14 [0060.888] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa8f8) returned 0x0 [0060.888] GetCurrentProcessId () returned 0xb14 [0060.888] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa8f8) returned 0x0 [0060.888] GetCurrentProcessId () returned 0xb14 [0060.888] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa8f8) returned 0x0 [0060.889] GetCurrentProcessId () returned 0xb14 [0060.889] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa8f8) returned 0x0 [0060.889] GetCurrentProcessId () returned 0xb14 [0060.889] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa8f8) returned 0x0 [0060.889] GetCurrentProcessId () returned 0xb14 [0060.889] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa8f8) returned 0x0 [0060.889] GetCurrentProcessId () returned 0xb14 [0060.889] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa8f8) returned 0x0 [0060.890] GetCurrentProcessId () returned 0xb14 [0060.890] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa8f8) returned 0x0 [0060.890] GetCurrentProcessId () returned 0xb14 [0060.890] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa8f8) returned 0x0 [0060.890] GetCurrentProcessId () returned 0xb14 [0060.890] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa8f8) returned 0x0 [0060.891] GetCurrentProcessId () returned 0xb14 [0060.891] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa8f8) returned 0x0 [0060.902] GetCurrentProcessId () returned 0xb14 [0060.902] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.902] GetCurrentProcessId () returned 0xb14 [0060.902] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.902] GetCurrentProcessId () returned 0xb14 [0060.902] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.903] GetCurrentProcessId () returned 0xb14 [0060.903] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.903] GetCurrentProcessId () returned 0xb14 [0060.903] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.903] GetCurrentProcessId () returned 0xb14 [0060.903] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.904] GetCurrentProcessId () returned 0xb14 [0060.904] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.904] GetCurrentProcessId () returned 0xb14 [0060.904] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.904] GetCurrentProcessId () returned 0xb14 [0060.904] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.908] GetCurrentProcessId () returned 0xb14 [0060.908] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.908] GetCurrentProcessId () returned 0xb14 [0060.908] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.908] GetCurrentProcessId () returned 0xb14 [0060.908] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.909] GetCurrentProcessId () returned 0xb14 [0060.909] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.909] GetCurrentProcessId () returned 0xb14 [0060.909] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.909] GetCurrentProcessId () returned 0xb14 [0060.909] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.910] GetCurrentProcessId () returned 0xb14 [0060.910] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.910] GetCurrentProcessId () returned 0xb14 [0060.910] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.910] GetCurrentProcessId () returned 0xb14 [0060.910] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.910] GetCurrentProcessId () returned 0xb14 [0060.911] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.911] GetCurrentProcessId () returned 0xb14 [0060.911] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.911] GetCurrentProcessId () returned 0xb14 [0060.911] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.911] GetCurrentProcessId () returned 0xb14 [0060.911] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.912] GetCurrentProcessId () returned 0xb14 [0060.912] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.912] GetCurrentProcessId () returned 0xb14 [0060.912] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.912] GetCurrentProcessId () returned 0xb14 [0060.912] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.913] GetCurrentProcessId () returned 0xb14 [0060.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.913] GetCurrentProcessId () returned 0xb14 [0060.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.913] GetCurrentProcessId () returned 0xb14 [0060.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.913] GetCurrentProcessId () returned 0xb14 [0060.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.914] GetCurrentProcessId () returned 0xb14 [0060.914] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.914] GetCurrentProcessId () returned 0xb14 [0060.914] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.914] GetCurrentProcessId () returned 0xb14 [0060.914] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.915] GetCurrentProcessId () returned 0xb14 [0060.915] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.915] GetCurrentProcessId () returned 0xb14 [0060.915] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.918] GetCurrentProcessId () returned 0xb14 [0060.918] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.918] GetCurrentProcessId () returned 0xb14 [0060.918] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.919] GetCurrentProcessId () returned 0xb14 [0060.919] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.919] GetCurrentProcessId () returned 0xb14 [0060.919] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.919] GetCurrentProcessId () returned 0xb14 [0060.919] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.920] GetCurrentProcessId () returned 0xb14 [0060.920] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.920] GetCurrentProcessId () returned 0xb14 [0060.920] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.920] GetCurrentProcessId () returned 0xb14 [0060.920] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.921] GetCurrentProcessId () returned 0xb14 [0060.921] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.921] GetCurrentProcessId () returned 0xb14 [0060.921] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee04 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee04*=0xa938) returned 0x0 [0060.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee24 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee24*=0xa938) returned 0x0 [0060.926] GetCurrentProcessId () returned 0xb14 [0060.926] GetCurrentProcessId () returned 0xb14 [0060.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.926] GetCurrentProcessId () returned 0xb14 [0060.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.927] GetCurrentProcessId () returned 0xb14 [0060.927] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.927] GetCurrentProcessId () returned 0xb14 [0060.927] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.927] GetCurrentProcessId () returned 0xb14 [0060.927] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.928] GetCurrentProcessId () returned 0xb14 [0060.928] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.928] GetCurrentProcessId () returned 0xb14 [0060.928] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.928] GetCurrentProcessId () returned 0xb14 [0060.928] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.928] GetCurrentProcessId () returned 0xb14 [0060.928] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.929] GetCurrentProcessId () returned 0xb14 [0060.929] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.929] GetCurrentProcessId () returned 0xb14 [0060.929] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.929] GetCurrentProcessId () returned 0xb14 [0060.929] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.930] GetCurrentProcessId () returned 0xb14 [0060.930] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.930] GetCurrentProcessId () returned 0xb14 [0060.930] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.936] GetCurrentProcessId () returned 0xb14 [0060.936] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.936] GetCurrentProcessId () returned 0xb14 [0060.936] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.936] GetCurrentProcessId () returned 0xb14 [0060.936] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.937] GetCurrentProcessId () returned 0xb14 [0060.937] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.937] GetCurrentProcessId () returned 0xb14 [0060.937] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.937] GetCurrentProcessId () returned 0xb14 [0060.937] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.938] GetCurrentProcessId () returned 0xb14 [0060.938] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.938] GetCurrentProcessId () returned 0xb14 [0060.938] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.939] GetCurrentProcessId () returned 0xb14 [0060.939] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.939] GetCurrentProcessId () returned 0xb14 [0060.939] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.939] GetCurrentProcessId () returned 0xb14 [0060.939] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.940] GetCurrentProcessId () returned 0xb14 [0060.940] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.940] GetCurrentProcessId () returned 0xb14 [0060.940] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.940] GetCurrentProcessId () returned 0xb14 [0060.940] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.941] GetCurrentProcessId () returned 0xb14 [0060.941] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.941] GetCurrentProcessId () returned 0xb14 [0060.941] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.941] GetCurrentProcessId () returned 0xb14 [0060.941] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.941] GetCurrentProcessId () returned 0xb14 [0060.941] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.942] GetCurrentProcessId () returned 0xb14 [0060.942] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.942] GetCurrentProcessId () returned 0xb14 [0060.942] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.942] GetCurrentProcessId () returned 0xb14 [0060.942] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.943] GetCurrentProcessId () returned 0xb14 [0060.943] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.943] GetCurrentProcessId () returned 0xb14 [0060.943] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.943] GetCurrentProcessId () returned 0xb14 [0060.943] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.996] GetCurrentProcessId () returned 0xb14 [0060.996] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.996] GetCurrentProcessId () returned 0xb14 [0060.996] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.997] GetCurrentProcessId () returned 0xb14 [0060.997] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.997] GetCurrentProcessId () returned 0xb14 [0060.997] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.997] GetCurrentProcessId () returned 0xb14 [0060.997] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.998] GetCurrentProcessId () returned 0xb14 [0060.998] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.998] GetCurrentProcessId () returned 0xb14 [0060.998] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.998] GetCurrentProcessId () returned 0xb14 [0060.998] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.999] GetCurrentProcessId () returned 0xb14 [0060.999] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.999] GetCurrentProcessId () returned 0xb14 [0060.999] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0060.999] GetCurrentProcessId () returned 0xb14 [0060.999] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0061.000] GetCurrentProcessId () returned 0xb14 [0061.000] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0061.000] GetCurrentProcessId () returned 0xb14 [0061.000] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0061.000] GetCurrentProcessId () returned 0xb14 [0061.000] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0061.000] GetCurrentProcessId () returned 0xb14 [0061.000] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0061.001] GetCurrentProcessId () returned 0xb14 [0061.001] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0061.001] GetCurrentProcessId () returned 0xb14 [0061.001] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0061.001] GetCurrentProcessId () returned 0xb14 [0061.001] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0061.002] GetCurrentProcessId () returned 0xb14 [0061.002] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0061.002] GetCurrentProcessId () returned 0xb14 [0061.002] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee18 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee18*=0xa938) returned 0x0 [0061.002] GetCurrentProcessId () returned 0xb14 [0061.004] GetCurrentProcessId () returned 0xb14 [0061.009] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee54 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee54*=0xa938) returned 0x0 [0061.013] SleepEx (dwMilliseconds=0x258, bAlertable=1) returned 0x0 [0061.609] GetCurrentProcessId () returned 0xb14 [0061.609] GetCurrentProcessId () returned 0xb14 [0061.609] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee54 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee54*=0xa6e0) returned 0x0 [0061.609] SleepEx (dwMilliseconds=0x258, bAlertable=1) returned 0x0 [0062.228] GetCurrentProcessId () returned 0xb14 [0062.228] GetCurrentProcessId () returned 0xb14 [0062.228] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee54 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee54*=0xa760) returned 0x0 [0062.229] SleepEx (dwMilliseconds=0x258, bAlertable=1) returned 0x0 [0062.830] GetCurrentProcessId () returned 0xb14 [0062.835] GetCurrentProcessId () returned 0xb14 [0062.835] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee54 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee54*=0xa760) returned 0x0 [0062.867] SleepEx (dwMilliseconds=0x258, bAlertable=1) returned 0x0 [0063.537] GetCurrentProcessId () returned 0xb14 [0063.537] GetCurrentProcessId () returned 0xb14 [0063.537] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3663cf0, Length=0x20000, ResultLength=0x512ee54 | out: SystemInformation=0x3663cf0, ResultLength=0x512ee54*=0xa3f8) returned 0x0 Thread: id = 79 os_tid = 0xb34 [0069.129] CoGetContextToken (in: pToken=0x4e2f74c | out: pToken=0x4e2f74c) returned 0x0 [0069.130] IUnknown:QueryInterface (in: This=0x8dcc98, riid=0x7404d8c4*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e2f770 | out: ppvObject=0x4e2f770*=0x8dcca4) returned 0x0 [0069.144] IComThreadingInfo:GetCurrentThreadType (in: This=0x8dcca4, pThreadType=0x4e2f79c | out: pThreadType=0x4e2f79c*=0) returned 0x0 [0069.144] IUnknown:Release (This=0x8dcca4) returned 0x0 Thread: id = 80 os_tid = 0xb38 Thread: id = 81 os_tid = 0xb3c Thread: id = 82 os_tid = 0xb40 Thread: id = 83 os_tid = 0xb44 Thread: id = 117 os_tid = 0x414 [0060.378] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0060.414] ShellExecuteExW (in: pExecInfo=0x260aee0*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="cmd.exe", lpParameters="/C choice /C Y /N /D Y /T 3 & Del \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\"", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x260aee0*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="cmd.exe", lpParameters="/C choice /C Y /N /D Y /T 3 & Del \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\"", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x474)) returned 1 [0060.635] CoGetContextToken (in: pToken=0x5baf400 | out: pToken=0x5baf400) returned 0x0 [0060.635] CoUninitialize () Thread: id = 118 os_tid = 0x494 Thread: id = 121 os_tid = 0x30c [0062.225] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0062.225] CoGetContextToken (in: pToken=0x673fac4 | out: pToken=0x673fac4) returned 0x0 [0062.225] IUnknown:QueryInterface (in: This=0x8dcc98, riid=0x7404d8c4*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x673fae8 | out: ppvObject=0x673fae8*=0x8dcca4) returned 0x0 [0062.225] IComThreadingInfo:GetCurrentThreadType (in: This=0x8dcca4, pThreadType=0x673fb14 | out: pThreadType=0x673fb14*=0) returned 0x0 [0062.225] IUnknown:Release (This=0x8dcca4) returned 0x0 [0062.225] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0062.225] CoUninitialize () [0062.227] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.250] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.254] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.273] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.277] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.285] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.298] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.316] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.325] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.329] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.333] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.337] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.342] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.346] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.350] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.354] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.359] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.364] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.372] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.377] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.389] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.390] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.407] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.420] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.429] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.438] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.449] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.498] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.545] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.591] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.592] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.601] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.605] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.609] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.613] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.618] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.626] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.630] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.634] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.638] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.651] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.659] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.664] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.668] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.672] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.676] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.685] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0062.689] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.263] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.284] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.315] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.329] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.329] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.356] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.414] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.482] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.561] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.584] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.612] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.915] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.957] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.976] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.997] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.001] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.014] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.023] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.031] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.045] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.053] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.062] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.070] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 Thread: id = 122 os_tid = 0x58c Thread: id = 125 os_tid = 0x928 [0077.282] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0077.282] CoGetContextToken (in: pToken=0x64ff9c4 | out: pToken=0x64ff9c4) returned 0x0 [0077.282] IUnknown:QueryInterface (in: This=0x8dcc98, riid=0x7404d8c4*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x64ff9e8 | out: ppvObject=0x64ff9e8*=0x8dcca4) returned 0x0 [0077.283] IComThreadingInfo:GetCurrentThreadType (in: This=0x8dcca4, pThreadType=0x64ffa14 | out: pThreadType=0x64ffa14*=0) returned 0x0 [0077.283] IUnknown:Release (This=0x8dcca4) returned 0x0 [0077.283] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0077.283] CoUninitialize () [0077.283] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.311] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.325] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.329] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.333] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.360] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.401] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.441] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.525] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.562] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.609] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.685] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.913] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.956] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.961] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.984] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0077.997] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.005] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.018] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.027] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.045] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.049] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.062] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.066] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.074] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.082] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.088] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.097] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.101] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.105] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.110] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.114] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.127] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.131] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.139] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.144] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.148] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.152] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.157] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.161] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.169] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.174] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.178] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.182] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.187] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.196] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.200] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.204] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.209] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0078.213] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 Thread: id = 126 os_tid = 0x930 Process: id = "6" image_name = "regasm.exe" filename = "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\regasm.exe" page_root = "0x60483000" os_pid = "0xb48" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xa20" cmd_line = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 84 os_tid = 0xb4c [0053.654] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0058.421] CoTaskMemAlloc (cb=0x20c) returned 0x754808 [0058.421] SHGetFolderPathW (in: hwnd=0x0, csidl=13, hToken=0x0, dwFlags=0x0, pszPath=0x754808 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned 0x0 [0058.424] CoTaskMemFree (pv=0x754808) [0058.429] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music", nBufferLength=0x105, lpBuffer=0x2ed2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music", lpFilePart=0x0) returned 0x23 [0058.460] OpenMutexW (dwDesiredAccess=0x100001, bInheritHandle=0, lpName="92d3ce18e22c4e57b8d53faf2f44156a_logger") returned 0x0 [0058.471] EtwEventRegister () returned 0x0 [0058.488] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=1, lpName="92d3ce18e22c4e57b8d53faf2f44156a_logger") returned 0x200 [0058.623] GetTimeZoneInformation (in: lpTimeZoneInformation=0x2eed90 | out: lpTimeZoneInformation=0x2eed90) returned 0x1 [0058.649] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x2eebe4 | out: pTimeZoneInformation=0x2eebe4) returned 0x1 [0058.653] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\AUS Eastern Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x2eecc8 | out: phkResult=0x2eecc8*=0x210) returned 0x0 [0058.653] RegQueryValueExW (in: hKey=0x210, lpValueName="TZI", lpReserved=0x0, lpType=0x2eece4, lpData=0x0, lpcbData=0x2eece0*=0x0 | out: lpType=0x2eece4*=0x3, lpData=0x0, lpcbData=0x2eece0*=0x2c) returned 0x0 [0058.653] RegQueryValueExW (in: hKey=0x210, lpValueName="TZI", lpReserved=0x0, lpType=0x2eece4, lpData=0x2354f80, lpcbData=0x2eece0*=0x2c | out: lpType=0x2eece4*=0x3, lpData=0x2354f80*, lpcbData=0x2eece0*=0x2c) returned 0x0 [0058.654] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\AUS Eastern Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x2eeb1c | out: phkResult=0x2eeb1c*=0x214) returned 0x0 [0058.654] RegQueryValueExW (in: hKey=0x214, lpValueName="FirstEntry", lpReserved=0x0, lpType=0x2eeb38, lpData=0x0, lpcbData=0x2eeb34*=0x0 | out: lpType=0x2eeb38*=0x4, lpData=0x0, lpcbData=0x2eeb34*=0x4) returned 0x0 [0058.654] RegQueryValueExW (in: hKey=0x214, lpValueName="FirstEntry", lpReserved=0x0, lpType=0x2eeb38, lpData=0x2eeb24, lpcbData=0x2eeb34*=0x4 | out: lpType=0x2eeb38*=0x4, lpData=0x2eeb24*=0x7d7, lpcbData=0x2eeb34*=0x4) returned 0x0 [0058.654] RegQueryValueExW (in: hKey=0x214, lpValueName="LastEntry", lpReserved=0x0, lpType=0x2eeb38, lpData=0x0, lpcbData=0x2eeb34*=0x0 | out: lpType=0x2eeb38*=0x4, lpData=0x0, lpcbData=0x2eeb34*=0x4) returned 0x0 [0058.654] RegQueryValueExW (in: hKey=0x214, lpValueName="LastEntry", lpReserved=0x0, lpType=0x2eeb38, lpData=0x2eeb24, lpcbData=0x2eeb34*=0x4 | out: lpType=0x2eeb38*=0x4, lpData=0x2eeb24*=0x7d8, lpcbData=0x2eeb34*=0x4) returned 0x0 [0058.655] RegQueryValueExW (in: hKey=0x214, lpValueName="2007", lpReserved=0x0, lpType=0x2eeb38, lpData=0x0, lpcbData=0x2eeb34*=0x0 | out: lpType=0x2eeb38*=0x3, lpData=0x0, lpcbData=0x2eeb34*=0x2c) returned 0x0 [0058.655] RegQueryValueExW (in: hKey=0x214, lpValueName="2007", lpReserved=0x0, lpType=0x2eeb38, lpData=0x23555e4, lpcbData=0x2eeb34*=0x2c | out: lpType=0x2eeb38*=0x3, lpData=0x23555e4*, lpcbData=0x2eeb34*=0x2c) returned 0x0 [0058.655] RegQueryValueExW (in: hKey=0x214, lpValueName="2008", lpReserved=0x0, lpType=0x2eeb38, lpData=0x0, lpcbData=0x2eeb34*=0x0 | out: lpType=0x2eeb38*=0x3, lpData=0x0, lpcbData=0x2eeb34*=0x2c) returned 0x0 [0058.655] RegQueryValueExW (in: hKey=0x214, lpValueName="2008", lpReserved=0x0, lpType=0x2eeb38, lpData=0x23556a4, lpcbData=0x2eeb34*=0x2c | out: lpType=0x2eeb38*=0x3, lpData=0x23556a4*, lpcbData=0x2eeb34*=0x2c) returned 0x0 [0058.655] RegCloseKey (hKey=0x214) returned 0x0 [0058.655] RegQueryValueExW (in: hKey=0x210, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x2eecbc, lpData=0x0, lpcbData=0x2eecb8*=0x0 | out: lpType=0x2eecbc*=0x1, lpData=0x0, lpcbData=0x2eecb8*=0x20) returned 0x0 [0058.655] RegQueryValueExW (in: hKey=0x210, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x2eecbc, lpData=0x23557ec, lpcbData=0x2eecb8*=0x20 | out: lpType=0x2eecbc*=0x1, lpData="@tzres.dll,-670", lpcbData=0x2eecb8*=0x20) returned 0x0 [0058.655] RegQueryValueExW (in: hKey=0x210, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x2eecbc, lpData=0x0, lpcbData=0x2eecb8*=0x0 | out: lpType=0x2eecbc*=0x1, lpData=0x0, lpcbData=0x2eecb8*=0x20) returned 0x0 [0058.655] RegQueryValueExW (in: hKey=0x210, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x2eecbc, lpData=0x2355844, lpcbData=0x2eecb8*=0x20 | out: lpType=0x2eecbc*=0x1, lpData="@tzres.dll,-672", lpcbData=0x2eecb8*=0x20) returned 0x0 [0058.655] RegQueryValueExW (in: hKey=0x210, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x2eecbc, lpData=0x0, lpcbData=0x2eecb8*=0x0 | out: lpType=0x2eecbc*=0x1, lpData=0x0, lpcbData=0x2eecb8*=0x20) returned 0x0 [0058.655] RegQueryValueExW (in: hKey=0x210, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x2eecbc, lpData=0x235589c, lpcbData=0x2eecb8*=0x20 | out: lpType=0x2eecbc*=0x1, lpData="@tzres.dll,-671", lpcbData=0x2eecb8*=0x20) returned 0x0 [0058.656] CoTaskMemAlloc (cb=0x20c) returned 0x772f58 [0058.657] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x772f58 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0058.657] CoTaskMemFree (pv=0x772f58) [0058.658] CoTaskMemAlloc (cb=0x20c) returned 0x772f58 [0058.658] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x2eecd8, pwszFileMUIPath=0x772f58, pcchFileMUIPath=0x2eecdc, pululEnumerator=0x2eecd0 | out: pwszLanguage=0x0, pcchLanguage=0x2eecd8, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x2eecdc, pululEnumerator=0x2eecd0) returned 1 [0058.667] CoTaskMemFree (pv=0x0) [0058.667] CoTaskMemFree (pv=0x772f58) [0058.668] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x2f0001 [0058.676] CoTaskMemAlloc (cb=0x3ec) returned 0x772f58 [0058.676] LoadStringW (in: hInstance=0x2f0001, uID=0x29e, lpBuffer=0x772f58, cchBufferMax=500 | out: lpBuffer="(UTC+10:00) Canberra, Melbourne, Sydney") returned 0x27 [0058.676] CoTaskMemFree (pv=0x772f58) [0058.676] FreeLibrary (hLibModule=0x2f0001) returned 1 [0058.677] CoTaskMemAlloc (cb=0x20c) returned 0x772f58 [0058.677] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x772f58 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0058.677] CoTaskMemFree (pv=0x772f58) [0058.677] CoTaskMemAlloc (cb=0x20c) returned 0x772f58 [0058.677] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x2eecd8, pwszFileMUIPath=0x772f58, pcchFileMUIPath=0x2eecdc, pululEnumerator=0x2eecd0 | out: pwszLanguage=0x0, pcchLanguage=0x2eecd8, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x2eecdc, pululEnumerator=0x2eecd0) returned 1 [0058.678] CoTaskMemFree (pv=0x0) [0058.678] CoTaskMemFree (pv=0x772f58) [0058.678] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x2f0001 [0058.678] CoTaskMemAlloc (cb=0x3ec) returned 0x772f58 [0058.678] LoadStringW (in: hInstance=0x2f0001, uID=0x2a0, lpBuffer=0x772f58, cchBufferMax=500 | out: lpBuffer="AUS Eastern Standard Time") returned 0x19 [0058.678] CoTaskMemFree (pv=0x772f58) [0058.678] FreeLibrary (hLibModule=0x2f0001) returned 1 [0058.679] CoTaskMemAlloc (cb=0x20c) returned 0x772f58 [0058.679] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x772f58 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0058.679] CoTaskMemFree (pv=0x772f58) [0058.679] CoTaskMemAlloc (cb=0x20c) returned 0x772f58 [0058.679] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x2eecd8, pwszFileMUIPath=0x772f58, pcchFileMUIPath=0x2eecdc, pululEnumerator=0x2eecd0 | out: pwszLanguage=0x0, pcchLanguage=0x2eecd8, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x2eecdc, pululEnumerator=0x2eecd0) returned 1 [0058.680] CoTaskMemFree (pv=0x0) [0058.680] CoTaskMemFree (pv=0x772f58) [0058.680] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x2f0001 [0058.680] CoTaskMemAlloc (cb=0x3ec) returned 0x772f58 [0058.680] LoadStringW (in: hInstance=0x2f0001, uID=0x29f, lpBuffer=0x772f58, cchBufferMax=500 | out: lpBuffer="AUS Eastern Daylight Time") returned 0x19 [0058.680] CoTaskMemFree (pv=0x772f58) [0058.680] FreeLibrary (hLibModule=0x2f0001) returned 1 [0058.681] RegCloseKey (hKey=0x210) returned 0x0 [0058.714] GetCurrentProcess () returned 0xffffffff [0058.714] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x2eef08 | out: TokenHandle=0x2eef08*=0x210) returned 1 [0058.717] GetTokenInformation (in: TokenHandle=0x210, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x2eef08 | out: TokenInformation=0x0, ReturnLength=0x2eef08) returned 0 [0058.717] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x7629a0 [0058.717] GetTokenInformation (in: TokenHandle=0x210, TokenInformationClass=0x8, TokenInformation=0x7629a0, TokenInformationLength=0x4, ReturnLength=0x2eef08 | out: TokenInformation=0x7629a0, ReturnLength=0x2eef08) returned 1 [0058.717] LocalFree (hMem=0x7629a0) returned 0x0 [0058.718] DuplicateTokenEx (in: hExistingToken=0x210, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x2eef10 | out: phNewToken=0x2eef10*=0x21c) returned 1 [0058.718] CheckTokenMembership (in: TokenHandle=0x21c, SidToCheck=0x2359dc0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x2eef20 | out: IsMember=0x2eef20) returned 1 [0058.718] CloseHandle (hObject=0x21c) returned 1 [0058.722] CoTaskMemAlloc (cb=0x20e) returned 0x772f58 [0058.722] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x772f58 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0058.722] CoTaskMemFree (pv=0x772f58) [0058.724] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"schtasks\" /delete /tn \"\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2eed98*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x235a128 | out: lpCommandLine="\"schtasks\" /delete /tn \"\" /f", lpProcessInformation=0x235a128*(hProcess=0x218, hThread=0x21c, dwProcessId=0xbc8, dwThreadId=0xbcc)) returned 1 [0058.734] CloseHandle (hObject=0x21c) returned 1 [0058.735] GetCurrentProcess () returned 0xffffffff [0058.735] GetCurrentProcess () returned 0xffffffff [0058.735] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x218, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x2eef04, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x2eef04*=0x21c) returned 1 [0059.184] CloseHandle (hObject=0x21c) returned 1 [0059.184] GetExitCodeProcess (in: hProcess=0x218, lpExitCode=0x2eef64 | out: lpExitCode=0x2eef64*=0x1) returned 1 [0059.194] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2011f, phkResult=0x2eeef4 | out: phkResult=0x2eeef4*=0x21c) returned 0x0 [0059.195] RegDeleteValueW (hKey=0x21c, lpValueName="") returned 0x2 [0059.201] RegCloseKey (hKey=0x21c) returned 0x0 [0059.226] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe", nBufferLength=0x105, lpBuffer=0x2eea14, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe", lpFilePart=0x0) returned 0x38 [0059.227] LocalAlloc (uFlags=0x0, uBytes=0xc0) returned 0x759668 [0059.503] LocalFree (hMem=0x765888) returned 0x0 [0059.503] LocalFree (hMem=0x759668) returned 0x0 [0059.504] CoGetContextToken (in: pToken=0x2eee48 | out: pToken=0x2eee48) returned 0x0 [0059.504] CObjectContext::QueryInterface () returned 0x0 [0059.504] CObjectContext::GetCurrentThreadType () returned 0x0 [0059.504] Release () returned 0x0 [0059.505] CoGetContextToken (in: pToken=0x2eeb64 | out: pToken=0x2eeb64) returned 0x0 [0059.505] CObjectContext::QueryInterface () returned 0x0 [0059.505] CObjectContext::GetCurrentThreadType () returned 0x0 [0059.505] Release () returned 0x0 [0059.505] CoGetContextToken (in: pToken=0x2eeb64 | out: pToken=0x2eeb64) returned 0x0 [0059.505] CObjectContext::QueryInterface () returned 0x0 [0059.505] CObjectContext::GetCurrentThreadType () returned 0x0 [0059.505] Release () returned 0x0 [0059.509] CoGetContextToken (in: pToken=0x2eeb64 | out: pToken=0x2eeb64) returned 0x0 [0059.509] CObjectContext::QueryInterface () returned 0x0 [0059.509] CObjectContext::GetCurrentThreadType () returned 0x0 [0059.509] Release () returned 0x0 [0059.510] CoGetContextToken (in: pToken=0x2eeb7c | out: pToken=0x2eeb7c) returned 0x0 [0059.510] CObjectContext::QueryInterface () returned 0x0 [0059.510] CObjectContext::GetCurrentThreadType () returned 0x0 [0059.510] Release () returned 0x0 [0059.510] CoUninitialize () Thread: id = 86 os_tid = 0xb54 Thread: id = 87 os_tid = 0xb58 [0053.655] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0059.505] EtwEventUnregister () returned 0x0 [0059.507] CloseHandle (hObject=0x218) returned 1 [0059.507] CloseHandle (hObject=0x210) returned 1 [0059.507] RegCloseKey (hKey=0x80000004) returned 0x0 [0059.508] CloseHandle (hObject=0x200) returned 1 [0059.508] CloseHandle (hObject=0x344) returned 1 [0059.510] SleepEx (dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 88 os_tid = 0xb5c Thread: id = 111 os_tid = 0xbe0 [0059.234] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0059.269] ShellExecuteExW (in: pExecInfo=0x235c8ac*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="cmd.exe", lpParameters="/C choice /C Y /N /D Y /T 3 & Del \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" /a", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x235c8ac*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="cmd.exe", lpParameters="/C choice /C Y /N /D Y /T 3 & Del \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" /a", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x344)) returned 1 [0059.476] CoGetContextToken (in: pToken=0x535fb00 | out: pToken=0x535fb00) returned 0x0 [0059.476] CoUninitialize () Thread: id = 112 os_tid = 0xbe4 Thread: id = 113 os_tid = 0xbe8 Process: id = "7" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x5e5c6000" os_pid = "0xb6c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xa20" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /C choice /C Y /N /D Y /T 3 & Del \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 92 os_tid = 0xb70 [0057.683] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x29fbd0 | out: lpSystemTimeAsFileTime=0x29fbd0*(dwLowDateTime=0xe115db00, dwHighDateTime=0x1d531b1)) [0057.684] GetCurrentProcessId () returned 0xb6c [0057.684] GetCurrentThreadId () returned 0xb70 [0057.684] GetTickCount () returned 0x1d3b2 [0057.684] QueryPerformanceCounter (in: lpPerformanceCount=0x29fbc8 | out: lpPerformanceCount=0x29fbc8*=17794521748) returned 1 [0057.685] GetModuleHandleA (lpModuleName=0x0) returned 0x4a8c0000 [0057.685] __set_app_type (_Type=0x1) [0057.685] __p__fmode () returned 0x74eb31f4 [0057.702] __p__commode () returned 0x74eb31fc [0057.702] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a8e21a6) returned 0x0 [0057.702] __getmainargs (in: _Argc=0x4a8e4238, _Argv=0x4a8e4240, _Env=0x4a8e423c, _DoWildCard=0, _StartInfo=0x4a8e4140 | out: _Argc=0x4a8e4238, _Argv=0x4a8e4240, _Env=0x4a8e423c) returned 0 [0057.702] GetCurrentThreadId () returned 0xb70 [0057.702] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb70) returned 0x60 [0057.702] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0057.703] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadUILanguage") returned 0x76c4a84f [0057.703] SetThreadUILanguage (LangId=0x0) returned 0x409 [0057.703] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0057.703] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x29fb60 | out: phkResult=0x29fb60*=0x0) returned 0x2 [0057.703] VirtualQuery (in: lpAddress=0x29fb97, lpBuffer=0x29fb30, dwLength=0x1c | out: lpBuffer=0x29fb30*(BaseAddress=0x29f000, AllocationBase=0x1a0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.703] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x29fb30, dwLength=0x1c | out: lpBuffer=0x29fb30*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0057.703] VirtualQuery (in: lpAddress=0x1a1000, lpBuffer=0x29fb30, dwLength=0x1c | out: lpBuffer=0x29fb30*(BaseAddress=0x1a1000, AllocationBase=0x1a0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0057.703] VirtualQuery (in: lpAddress=0x1a3000, lpBuffer=0x29fb30, dwLength=0x1c | out: lpBuffer=0x29fb30*(BaseAddress=0x1a3000, AllocationBase=0x1a0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.703] VirtualQuery (in: lpAddress=0x2a0000, lpBuffer=0x29fb30, dwLength=0x1c | out: lpBuffer=0x29fb30*(BaseAddress=0x2a0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xb0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0057.703] GetConsoleOutputCP () returned 0x1b5 [0057.703] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a8e4260 | out: lpCPInfo=0x4a8e4260) returned 1 [0057.704] SetConsoleCtrlHandler (HandlerRoutine=0x4a8de72a, Add=1) returned 1 [0057.704] _get_osfhandle (_FileHandle=1) returned 0x7 [0057.704] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0057.704] _get_osfhandle (_FileHandle=1) returned 0x7 [0057.704] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8e41ac | out: lpMode=0x4a8e41ac) returned 1 [0057.704] _get_osfhandle (_FileHandle=1) returned 0x7 [0057.704] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0057.704] _get_osfhandle (_FileHandle=0) returned 0x3 [0057.704] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8e41b0 | out: lpMode=0x4a8e41b0) returned 1 [0057.706] _get_osfhandle (_FileHandle=0) returned 0x3 [0057.706] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0057.706] GetEnvironmentStringsW () returned 0x4920e0* [0057.706] GetProcessHeap () returned 0x480000 [0057.706] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xaca) returned 0x492bb8 [0057.706] FreeEnvironmentStringsW (penv=0x4920e0) returned 1 [0057.706] GetProcessHeap () returned 0x480000 [0057.706] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x4) returned 0x491880 [0057.706] GetEnvironmentStringsW () returned 0x4920e0* [0057.706] GetProcessHeap () returned 0x480000 [0057.706] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xaca) returned 0x493690 [0057.706] FreeEnvironmentStringsW (penv=0x4920e0) returned 1 [0057.706] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x29ead0 | out: phkResult=0x29ead0*=0x68) returned 0x0 [0057.707] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x29ead8, lpData=0x29eadc, lpcbData=0x29ead4*=0x1000 | out: lpType=0x29ead8*=0x0, lpData=0x29eadc*=0x0, lpcbData=0x29ead4*=0x1000) returned 0x2 [0057.707] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x29ead8, lpData=0x29eadc, lpcbData=0x29ead4*=0x1000 | out: lpType=0x29ead8*=0x4, lpData=0x29eadc*=0x1, lpcbData=0x29ead4*=0x4) returned 0x0 [0057.707] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x29ead8, lpData=0x29eadc, lpcbData=0x29ead4*=0x1000 | out: lpType=0x29ead8*=0x0, lpData=0x29eadc*=0x1, lpcbData=0x29ead4*=0x1000) returned 0x2 [0057.707] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x29ead8, lpData=0x29eadc, lpcbData=0x29ead4*=0x1000 | out: lpType=0x29ead8*=0x4, lpData=0x29eadc*=0x0, lpcbData=0x29ead4*=0x4) returned 0x0 [0057.707] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x29ead8, lpData=0x29eadc, lpcbData=0x29ead4*=0x1000 | out: lpType=0x29ead8*=0x4, lpData=0x29eadc*=0x40, lpcbData=0x29ead4*=0x4) returned 0x0 [0057.707] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x29ead8, lpData=0x29eadc, lpcbData=0x29ead4*=0x1000 | out: lpType=0x29ead8*=0x4, lpData=0x29eadc*=0x40, lpcbData=0x29ead4*=0x4) returned 0x0 [0057.707] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x29ead8, lpData=0x29eadc, lpcbData=0x29ead4*=0x1000 | out: lpType=0x29ead8*=0x0, lpData=0x29eadc*=0x40, lpcbData=0x29ead4*=0x1000) returned 0x2 [0057.707] RegCloseKey (hKey=0x68) returned 0x0 [0057.707] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x29ead0 | out: phkResult=0x29ead0*=0x68) returned 0x0 [0057.707] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x29ead8, lpData=0x29eadc, lpcbData=0x29ead4*=0x1000 | out: lpType=0x29ead8*=0x0, lpData=0x29eadc*=0x40, lpcbData=0x29ead4*=0x1000) returned 0x2 [0057.707] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x29ead8, lpData=0x29eadc, lpcbData=0x29ead4*=0x1000 | out: lpType=0x29ead8*=0x4, lpData=0x29eadc*=0x1, lpcbData=0x29ead4*=0x4) returned 0x0 [0057.707] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x29ead8, lpData=0x29eadc, lpcbData=0x29ead4*=0x1000 | out: lpType=0x29ead8*=0x0, lpData=0x29eadc*=0x1, lpcbData=0x29ead4*=0x1000) returned 0x2 [0057.707] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x29ead8, lpData=0x29eadc, lpcbData=0x29ead4*=0x1000 | out: lpType=0x29ead8*=0x4, lpData=0x29eadc*=0x0, lpcbData=0x29ead4*=0x4) returned 0x0 [0057.707] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x29ead8, lpData=0x29eadc, lpcbData=0x29ead4*=0x1000 | out: lpType=0x29ead8*=0x4, lpData=0x29eadc*=0x9, lpcbData=0x29ead4*=0x4) returned 0x0 [0057.707] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x29ead8, lpData=0x29eadc, lpcbData=0x29ead4*=0x1000 | out: lpType=0x29ead8*=0x4, lpData=0x29eadc*=0x9, lpcbData=0x29ead4*=0x4) returned 0x0 [0057.707] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x29ead8, lpData=0x29eadc, lpcbData=0x29ead4*=0x1000 | out: lpType=0x29ead8*=0x0, lpData=0x29eadc*=0x9, lpcbData=0x29ead4*=0x1000) returned 0x2 [0057.707] RegCloseKey (hKey=0x68) returned 0x0 [0057.708] time (in: timer=0x0 | out: timer=0x0) returned 0x5d1cc61d [0057.708] srand (_Seed=0x5d1cc61d) [0057.708] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C choice /C Y /N /D Y /T 3 & Del \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe\"" [0057.708] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C choice /C Y /N /D Y /T 3 & Del \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe\"" [0057.709] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a8e5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0057.709] GetProcessHeap () returned 0x480000 [0057.709] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x210) returned 0x4920e0 [0057.709] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4920e8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0057.710] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a8f0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0057.710] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a8f0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0057.710] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a8f0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0057.710] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0057.710] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0057.710] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0057.710] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0057.710] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0057.710] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0057.710] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0057.710] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0057.710] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0057.710] GetProcessHeap () returned 0x480000 [0057.710] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x492bb8 | out: hHeap=0x480000) returned 1 [0057.710] GetEnvironmentStringsW () returned 0x4922f8* [0057.710] GetProcessHeap () returned 0x480000 [0057.710] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xae2) returned 0x494c58 [0057.710] FreeEnvironmentStringsW (penv=0x4922f8) returned 1 [0057.710] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a8f0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0057.710] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a8f0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0057.710] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0057.710] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0057.710] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0057.710] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0057.710] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0057.710] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0057.710] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0057.710] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0057.710] GetProcessHeap () returned 0x480000 [0057.710] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x54) returned 0x4917b0 [0057.711] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x29f89c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0057.711] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x29f89c, lpFilePart=0x29f898 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x29f898*="Desktop") returned 0x25 [0057.711] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0057.711] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x29f618 | out: lpFindFileData=0x29f618*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x495748 [0057.711] FindClose (in: hFindFile=0x495748 | out: hFindFile=0x495748) returned 1 [0057.711] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x29f618 | out: lpFindFileData=0x29f618*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x495748 [0057.711] FindClose (in: hFindFile=0x495748 | out: hFindFile=0x495748) returned 1 [0057.711] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0057.711] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x29f618 | out: lpFindFileData=0x29f618*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcf1cdf70, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xcf1cdf70, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x495748 [0057.711] FindClose (in: hFindFile=0x495748 | out: hFindFile=0x495748) returned 1 [0057.712] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0057.712] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0057.712] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0057.712] GetProcessHeap () returned 0x480000 [0057.712] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x494c58 | out: hHeap=0x480000) returned 1 [0057.712] GetEnvironmentStringsW () returned 0x494168* [0057.712] GetProcessHeap () returned 0x480000 [0057.712] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xb36) returned 0x495f88 [0057.712] FreeEnvironmentStringsW (penv=0x494168) returned 1 [0057.712] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a8e5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0057.712] GetProcessHeap () returned 0x480000 [0057.712] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x4917b0 | out: hHeap=0x480000) returned 1 [0057.712] GetProcessHeap () returned 0x480000 [0057.712] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x400e) returned 0x496ac8 [0057.712] GetProcessHeap () returned 0x480000 [0057.712] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xa6) returned 0x492e38 [0057.713] GetProcessHeap () returned 0x480000 [0057.713] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x496ac8 | out: hHeap=0x480000) returned 1 [0057.713] GetConsoleOutputCP () returned 0x1b5 [0057.713] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a8e4260 | out: lpCPInfo=0x4a8e4260) returned 1 [0057.713] GetUserDefaultLCID () returned 0x409 [0057.713] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a8e4950, cchData=8 | out: lpLCData=":") returned 2 [0057.714] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x29f9dc, cchData=128 | out: lpLCData="0") returned 2 [0057.714] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x29f9dc, cchData=128 | out: lpLCData="0") returned 2 [0057.714] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x29f9dc, cchData=128 | out: lpLCData="1") returned 2 [0057.714] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a8e4940, cchData=8 | out: lpLCData="/") returned 2 [0057.714] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a8e4d80, cchData=32 | out: lpLCData="Mon") returned 4 [0057.714] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a8e4d40, cchData=32 | out: lpLCData="Tue") returned 4 [0057.714] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a8e4d00, cchData=32 | out: lpLCData="Wed") returned 4 [0057.714] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a8e4cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0057.714] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a8e4c80, cchData=32 | out: lpLCData="Fri") returned 4 [0057.714] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a8e4c40, cchData=32 | out: lpLCData="Sat") returned 4 [0057.714] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a8e4c00, cchData=32 | out: lpLCData="Sun") returned 4 [0057.714] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a8e4930, cchData=8 | out: lpLCData=".") returned 2 [0057.714] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a8e4920, cchData=8 | out: lpLCData=",") returned 2 [0057.714] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0057.715] GetProcessHeap () returned 0x480000 [0057.715] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x0, Size=0x20c) returned 0x492ee8 [0057.715] GetConsoleTitleW (in: lpConsoleTitle=0x492ee8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0057.716] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0057.716] GetProcAddress (hModule=0x76c20000, lpProcName="CopyFileExW") returned 0x76c53b92 [0057.716] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0057.716] GetProcAddress (hModule=0x76c20000, lpProcName="SetConsoleInputExeNameW") returned 0x76c4a79d [0057.717] GetProcessHeap () returned 0x480000 [0057.717] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x400a) returned 0x496ac8 [0057.717] GetProcessHeap () returned 0x480000 [0057.717] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x496ac8 | out: hHeap=0x480000) returned 1 [0057.717] _wcsicmp (_String1="choice", _String2=")") returned 58 [0057.717] _wcsicmp (_String1="FOR", _String2="choice") returned 3 [0057.717] _wcsicmp (_String1="FOR/?", _String2="choice") returned 3 [0057.717] _wcsicmp (_String1="IF", _String2="choice") returned 6 [0057.717] _wcsicmp (_String1="IF/?", _String2="choice") returned 6 [0057.717] _wcsicmp (_String1="REM", _String2="choice") returned 15 [0057.717] _wcsicmp (_String1="REM/?", _String2="choice") returned 15 [0057.717] GetProcessHeap () returned 0x480000 [0057.717] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x58) returned 0x493100 [0057.717] GetProcessHeap () returned 0x480000 [0057.717] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x16) returned 0x4917e8 [0057.718] GetProcessHeap () returned 0x480000 [0057.718] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x30) returned 0x493160 [0057.718] GetProcessHeap () returned 0x480000 [0057.718] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x58) returned 0x493198 [0057.719] _wcsicmp (_String1="Del", _String2=")") returned 59 [0057.719] _wcsicmp (_String1="FOR", _String2="Del") returned 2 [0057.719] _wcsicmp (_String1="FOR/?", _String2="Del") returned 2 [0057.719] _wcsicmp (_String1="IF", _String2="Del") returned 5 [0057.719] _wcsicmp (_String1="IF/?", _String2="Del") returned 5 [0057.719] _wcsicmp (_String1="REM", _String2="Del") returned 14 [0057.719] _wcsicmp (_String1="REM/?", _String2="Del") returned 14 [0057.719] GetProcessHeap () returned 0x480000 [0057.719] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x58) returned 0x4931f8 [0057.719] GetProcessHeap () returned 0x480000 [0057.719] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x10) returned 0x48ffa8 [0057.720] GetProcessHeap () returned 0x480000 [0057.720] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x66) returned 0x493258 [0057.721] GetConsoleTitleW (in: lpConsoleTitle=0x29f670, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0057.721] _wcsicmp (_String1="choice", _String2="DIR") returned -1 [0057.721] _wcsicmp (_String1="choice", _String2="ERASE") returned -2 [0057.721] _wcsicmp (_String1="choice", _String2="DEL") returned -1 [0057.721] _wcsicmp (_String1="choice", _String2="TYPE") returned -17 [0057.721] _wcsicmp (_String1="choice", _String2="COPY") returned -7 [0057.721] _wcsicmp (_String1="choice", _String2="CD") returned 4 [0057.721] _wcsicmp (_String1="choice", _String2="CHDIR") returned 11 [0057.721] _wcsicmp (_String1="choice", _String2="RENAME") returned -15 [0057.721] _wcsicmp (_String1="choice", _String2="REN") returned -15 [0057.721] _wcsicmp (_String1="choice", _String2="ECHO") returned -2 [0057.721] _wcsicmp (_String1="choice", _String2="SET") returned -16 [0057.721] _wcsicmp (_String1="choice", _String2="PAUSE") returned -13 [0057.721] _wcsicmp (_String1="choice", _String2="DATE") returned -1 [0057.721] _wcsicmp (_String1="choice", _String2="TIME") returned -17 [0057.721] _wcsicmp (_String1="choice", _String2="PROMPT") returned -13 [0057.721] _wcsicmp (_String1="choice", _String2="MD") returned -10 [0057.721] _wcsicmp (_String1="choice", _String2="MKDIR") returned -10 [0057.721] _wcsicmp (_String1="choice", _String2="RD") returned -15 [0057.721] _wcsicmp (_String1="choice", _String2="RMDIR") returned -15 [0057.721] _wcsicmp (_String1="choice", _String2="PATH") returned -13 [0057.721] _wcsicmp (_String1="choice", _String2="GOTO") returned -4 [0057.721] _wcsicmp (_String1="choice", _String2="SHIFT") returned -16 [0057.721] _wcsicmp (_String1="choice", _String2="CLS") returned -4 [0057.721] _wcsicmp (_String1="choice", _String2="CALL") returned 7 [0057.722] _wcsicmp (_String1="choice", _String2="VERIFY") returned -19 [0057.722] _wcsicmp (_String1="choice", _String2="VER") returned -19 [0057.722] _wcsicmp (_String1="choice", _String2="VOL") returned -19 [0057.722] _wcsicmp (_String1="choice", _String2="EXIT") returned -2 [0057.722] _wcsicmp (_String1="choice", _String2="SETLOCAL") returned -16 [0057.722] _wcsicmp (_String1="choice", _String2="ENDLOCAL") returned -2 [0057.722] _wcsicmp (_String1="choice", _String2="TITLE") returned -17 [0057.722] _wcsicmp (_String1="choice", _String2="START") returned -16 [0057.722] _wcsicmp (_String1="choice", _String2="DPATH") returned -1 [0057.722] _wcsicmp (_String1="choice", _String2="KEYS") returned -8 [0057.722] _wcsicmp (_String1="choice", _String2="MOVE") returned -10 [0057.722] _wcsicmp (_String1="choice", _String2="PUSHD") returned -13 [0057.722] _wcsicmp (_String1="choice", _String2="POPD") returned -13 [0057.722] _wcsicmp (_String1="choice", _String2="ASSOC") returned 2 [0057.722] _wcsicmp (_String1="choice", _String2="FTYPE") returned -3 [0057.722] _wcsicmp (_String1="choice", _String2="BREAK") returned 1 [0057.722] _wcsicmp (_String1="choice", _String2="COLOR") returned -7 [0057.722] _wcsicmp (_String1="choice", _String2="MKLINK") returned -10 [0057.722] _wcsicmp (_String1="choice", _String2="DIR") returned -1 [0057.722] _wcsicmp (_String1="choice", _String2="ERASE") returned -2 [0057.722] _wcsicmp (_String1="choice", _String2="DEL") returned -1 [0057.722] _wcsicmp (_String1="choice", _String2="TYPE") returned -17 [0057.722] _wcsicmp (_String1="choice", _String2="COPY") returned -7 [0057.722] _wcsicmp (_String1="choice", _String2="CD") returned 4 [0057.722] _wcsicmp (_String1="choice", _String2="CHDIR") returned 11 [0057.722] _wcsicmp (_String1="choice", _String2="RENAME") returned -15 [0057.722] _wcsicmp (_String1="choice", _String2="REN") returned -15 [0057.722] _wcsicmp (_String1="choice", _String2="ECHO") returned -2 [0057.722] _wcsicmp (_String1="choice", _String2="SET") returned -16 [0057.722] _wcsicmp (_String1="choice", _String2="PAUSE") returned -13 [0057.722] _wcsicmp (_String1="choice", _String2="DATE") returned -1 [0057.722] _wcsicmp (_String1="choice", _String2="TIME") returned -17 [0057.722] _wcsicmp (_String1="choice", _String2="PROMPT") returned -13 [0057.722] _wcsicmp (_String1="choice", _String2="MD") returned -10 [0057.722] _wcsicmp (_String1="choice", _String2="MKDIR") returned -10 [0057.722] _wcsicmp (_String1="choice", _String2="RD") returned -15 [0057.722] _wcsicmp (_String1="choice", _String2="RMDIR") returned -15 [0057.722] _wcsicmp (_String1="choice", _String2="PATH") returned -13 [0057.722] _wcsicmp (_String1="choice", _String2="GOTO") returned -4 [0057.722] _wcsicmp (_String1="choice", _String2="SHIFT") returned -16 [0057.723] _wcsicmp (_String1="choice", _String2="CLS") returned -4 [0057.723] _wcsicmp (_String1="choice", _String2="CALL") returned 7 [0057.723] _wcsicmp (_String1="choice", _String2="VERIFY") returned -19 [0057.723] _wcsicmp (_String1="choice", _String2="VER") returned -19 [0057.723] _wcsicmp (_String1="choice", _String2="VOL") returned -19 [0057.723] _wcsicmp (_String1="choice", _String2="EXIT") returned -2 [0057.723] _wcsicmp (_String1="choice", _String2="SETLOCAL") returned -16 [0057.723] _wcsicmp (_String1="choice", _String2="ENDLOCAL") returned -2 [0057.723] _wcsicmp (_String1="choice", _String2="TITLE") returned -17 [0057.723] _wcsicmp (_String1="choice", _String2="START") returned -16 [0057.723] _wcsicmp (_String1="choice", _String2="DPATH") returned -1 [0057.723] _wcsicmp (_String1="choice", _String2="KEYS") returned -8 [0057.723] _wcsicmp (_String1="choice", _String2="MOVE") returned -10 [0057.723] _wcsicmp (_String1="choice", _String2="PUSHD") returned -13 [0057.723] _wcsicmp (_String1="choice", _String2="POPD") returned -13 [0057.723] _wcsicmp (_String1="choice", _String2="ASSOC") returned 2 [0057.723] _wcsicmp (_String1="choice", _String2="FTYPE") returned -3 [0057.723] _wcsicmp (_String1="choice", _String2="BREAK") returned 1 [0057.723] _wcsicmp (_String1="choice", _String2="COLOR") returned -7 [0057.723] _wcsicmp (_String1="choice", _String2="MKLINK") returned -10 [0057.723] _wcsicmp (_String1="choice", _String2="FOR") returned -3 [0057.723] _wcsicmp (_String1="choice", _String2="IF") returned -6 [0057.723] _wcsicmp (_String1="choice", _String2="REM") returned -15 [0057.723] GetProcessHeap () returned 0x480000 [0057.723] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x210) returned 0x4932c8 [0057.723] GetProcessHeap () returned 0x480000 [0057.723] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x3e) returned 0x4934e0 [0057.723] _wcsnicmp (_String1="choi", _String2="cmd ", _MaxCount=0x4) returned -5 [0057.724] GetProcessHeap () returned 0x480000 [0057.724] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x418) returned 0x4807f0 [0057.724] SetErrorMode (uMode=0x0) returned 0x0 [0057.724] SetErrorMode (uMode=0x1) returned 0x0 [0057.724] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4807f8, lpFilePart=0x29f190 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x29f190*="Desktop") returned 0x25 [0057.724] SetErrorMode (uMode=0x0) returned 0x1 [0057.724] GetProcessHeap () returned 0x480000 [0057.724] RtlReAllocateHeap (Heap=0x480000, Flags=0x0, Ptr=0x4807f0, Size=0x62) returned 0x4807f0 [0057.724] GetProcessHeap () returned 0x480000 [0057.724] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x4807f0) returned 0x62 [0057.724] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a8f0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0057.724] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0057.724] GetProcessHeap () returned 0x480000 [0057.724] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x120) returned 0x493528 [0057.724] GetProcessHeap () returned 0x480000 [0057.724] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x238) returned 0x480860 [0057.731] GetProcessHeap () returned 0x480000 [0057.731] RtlReAllocateHeap (Heap=0x480000, Flags=0x0, Ptr=0x480860, Size=0x122) returned 0x480860 [0057.731] GetProcessHeap () returned 0x480000 [0057.731] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x480860) returned 0x122 [0057.731] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a8f0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0057.731] GetProcessHeap () returned 0x480000 [0057.731] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xe0) returned 0x480990 [0057.731] GetProcessHeap () returned 0x480000 [0057.731] RtlReAllocateHeap (Heap=0x480000, Flags=0x0, Ptr=0x480990, Size=0x76) returned 0x480990 [0057.731] GetProcessHeap () returned 0x480000 [0057.731] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x480990) returned 0x76 [0057.735] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0057.735] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\choice.*", fInfoLevelId=0x1, lpFindFileData=0x29ef0c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x29ef0c) returned 0xffffffff [0057.735] GetLastError () returned 0x2 [0057.735] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\choice", fInfoLevelId=0x1, lpFindFileData=0x29ef0c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x29ef0c) returned 0xffffffff [0057.735] GetLastError () returned 0x2 [0057.735] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0057.735] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\choice.*", fInfoLevelId=0x1, lpFindFileData=0x29ef0c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x29ef0c) returned 0x493650 [0057.735] GetProcessHeap () returned 0x480000 [0057.735] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x0, Size=0x14) returned 0x480a10 [0057.736] FindClose (in: hFindFile=0x493650 | out: hFindFile=0x493650) returned 1 [0057.736] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\choice.COM", fInfoLevelId=0x1, lpFindFileData=0x29ef0c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x29ef0c) returned 0xffffffff [0057.736] GetLastError () returned 0x2 [0057.736] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\choice.EXE", fInfoLevelId=0x1, lpFindFileData=0x29ef0c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x29ef0c) returned 0x493650 [0057.736] GetProcessHeap () returned 0x480000 [0057.736] RtlReAllocateHeap (Heap=0x480000, Flags=0x0, Ptr=0x480a10, Size=0x4) returned 0x480a10 [0057.736] FindClose (in: hFindFile=0x493650 | out: hFindFile=0x493650) returned 1 [0057.736] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0057.736] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0057.736] GetConsoleTitleW (in: lpConsoleTitle=0x29f404, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0057.736] InitializeProcThreadAttributeList (in: lpAttributeList=0x29f28c, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x29f354 | out: lpAttributeList=0x29f28c, lpSize=0x29f354) returned 1 [0057.736] UpdateProcThreadAttribute (in: lpAttributeList=0x29f28c, dwFlags=0x0, Attribute=0x60001, lpValue=0x29f34c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x29f28c, lpPreviousValue=0x0) returned 1 [0057.736] GetStartupInfoW (in: lpStartupInfo=0x29f248 | out: lpStartupInfo=0x29f248*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0057.736] GetProcessHeap () returned 0x480000 [0057.736] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x18) returned 0x493650 [0057.736] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0057.736] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0057.736] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0057.736] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0057.737] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0057.737] GetProcessHeap () returned 0x480000 [0057.737] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x493650 | out: hHeap=0x480000) returned 1 [0057.737] GetProcessHeap () returned 0x480000 [0057.738] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xa) returned 0x48ffc0 [0057.738] lstrcmpW (lpString1="\\choice.exe", lpString2="\\XCOPY.EXE") returned -1 [0057.739] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\choice.exe", lpCommandLine="choice /C Y /N /D Y /T 3 ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x29f2e8*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="choice /C Y /N /D Y /T 3 ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x29f334 | out: lpCommandLine="choice /C Y /N /D Y /T 3 ", lpProcessInformation=0x29f334*(hProcess=0x78, hThread=0x74, dwProcessId=0xb84, dwThreadId=0xb88)) returned 1 [0057.749] CloseHandle (hObject=0x74) returned 1 [0057.749] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0057.749] GetProcessHeap () returned 0x480000 [0057.749] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x495f88 | out: hHeap=0x480000) returned 1 [0057.749] GetEnvironmentStringsW () returned 0x495f88* [0057.749] GetProcessHeap () returned 0x480000 [0057.749] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xb36) returned 0x494168 [0057.749] FreeEnvironmentStringsW (penv=0x495f88) returned 1 [0057.749] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0061.323] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x29f228 | out: lpExitCode=0x29f228*=0x1) returned 1 [0061.323] CloseHandle (hObject=0x78) returned 1 [0061.323] _vsnwprintf (in: _Buffer=0x29f370, _BufferCount=0x13, _Format="%08X", _ArgList=0x29f234 | out: _Buffer="00000001") returned 8 [0061.323] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000001") returned 1 [0061.323] GetProcessHeap () returned 0x480000 [0061.323] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x494168 | out: hHeap=0x480000) returned 1 [0061.323] GetEnvironmentStringsW () returned 0x494168* [0061.324] GetProcessHeap () returned 0x480000 [0061.324] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xb5c) returned 0x499630 [0061.324] FreeEnvironmentStringsW (penv=0x494168) returned 1 [0061.324] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0061.324] GetProcessHeap () returned 0x480000 [0061.324] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x499630 | out: hHeap=0x480000) returned 1 [0061.324] GetEnvironmentStringsW () returned 0x494168* [0061.324] GetProcessHeap () returned 0x480000 [0061.324] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xb5c) returned 0x499630 [0061.324] FreeEnvironmentStringsW (penv=0x494168) returned 1 [0061.324] GetProcessHeap () returned 0x480000 [0061.324] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48ffc0 | out: hHeap=0x480000) returned 1 [0061.324] DeleteProcThreadAttributeList (in: lpAttributeList=0x29f28c | out: lpAttributeList=0x29f28c) [0061.324] GetConsoleTitleW (in: lpConsoleTitle=0x29f670, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0061.324] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xc4) returned 0x480a20 [0061.324] RtlReAllocateHeap (Heap=0x480000, Flags=0x0, Ptr=0x480a20, Size=0x66) returned 0x480a20 [0061.324] GetProcessHeap () returned 0x480000 [0061.324] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x480a20) returned 0x66 [0061.324] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x6e) returned 0x480c60 [0061.325] GetProcessHeap () returned 0x480000 [0061.325] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xc4) returned 0x480cd8 [0061.325] RtlReAllocateHeap (Heap=0x480000, Flags=0x0, Ptr=0x480cd8, Size=0x66) returned 0x480cd8 [0061.325] GetProcessHeap () returned 0x480000 [0061.325] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x480cd8) returned 0x66 [0061.325] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x60) returned 0x480d48 [0061.325] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x29f428 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0061.325] GetProcessHeap () returned 0x480000 [0061.325] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x38) returned 0x48f4a8 [0061.325] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x29e4b8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0061.325] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x29e6e8, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x29e6ec, nFileSystemNameSize=0x106 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x29e6e8*=0xff, lpFileSystemFlags=0x0, lpFileSystemNameBuffer="NTFS") returned 1 [0061.326] _wcsicmp (_String1="NTFS", _String2="FAT") returned 8 [0061.326] GetProcessHeap () returned 0x480000 [0061.326] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x2c) returned 0x480a90 [0061.326] GetProcessHeap () returned 0x480000 [0061.326] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x258) returned 0x480db0 [0061.326] _wcsicmp (_String1="1.exe", _String2=".") returned 3 [0061.326] _wcsicmp (_String1="1.exe", _String2="..") returned 3 [0061.326] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1.exe")) returned 0x20 [0061.326] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x210) returned 0x481010 [0061.326] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x481018 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0061.326] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe", nBufferLength=0x104, lpBuffer=0x29eb0c, lpFilePart=0x29eaf4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe", lpFilePart=0x29eaf4*="1.exe") returned 0x2b [0061.326] SetErrorMode (uMode=0x0) returned 0x1 [0061.326] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0061.326] GetProcessHeap () returned 0x480000 [0061.326] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x258) returned 0x4922f8 [0061.327] _wcsicmp (_String1="1.exe", _String2=".") returned 3 [0061.327] _wcsicmp (_String1="1.exe", _String2="..") returned 3 [0061.327] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1.exe")) returned 0x20 [0061.327] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x14) returned 0x493670 [0061.327] GetProcessHeap () returned 0x480000 [0061.327] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x54) returned 0x481228 [0061.327] GetProcessHeap () returned 0x480000 [0061.327] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x54) returned 0x492558 [0061.327] GetProcessHeap () returned 0x480000 [0061.327] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x808) returned 0x4925b8 [0061.327] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe", fInfoLevelId=0x0, lpFindFileData=0x4925c4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4925c4) returned 0x481288 [0061.327] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1.exe")) returned 0 [0061.328] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1.exe")) returned 0 [0061.328] GetLastError () returned 0x5 [0061.328] _vsnwprintf (in: _Buffer=0x4a8f4640, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0x29e9f8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe\r\n") returned 45 [0061.329] _get_osfhandle (_FileHandle=1) returned 0x7 [0061.329] GetFileType (hFile=0x7) returned 0x2 [0061.330] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0061.330] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x29e9b8 | out: lpMode=0x29e9b8) returned 1 [0061.330] _get_osfhandle (_FileHandle=1) returned 0x7 [0061.330] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a8f4640*, nNumberOfCharsToWrite=0x2d, lpNumberOfCharsWritten=0x29e9e4, lpReserved=0x0 | out: lpBuffer=0x4a8f4640*, lpNumberOfCharsWritten=0x29e9e4*=0x2d) returned 1 [0061.330] _get_osfhandle (_FileHandle=2) returned 0xb [0061.330] GetFileType (hFile=0xb) returned 0x2 [0061.330] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0061.330] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x29e96c | out: lpMode=0x29e96c) returned 1 [0061.331] _get_osfhandle (_FileHandle=2) returned 0xb [0061.331] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x29e9a0 | out: lpConsoleScreenBufferInfo=0x29e9a0) returned 1 [0061.331] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x4a8f4640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Access is denied.\r\n") returned 0x13 [0061.342] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x4a8f4640, nSize=0x2000, Arguments=0x29e9e0 | out: lpBuffer="Access is denied.\r\n") returned 0x13 [0061.342] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a8f4640*, nNumberOfCharsToWrite=0x13, lpNumberOfCharsWritten=0x29e9c4, lpReserved=0x0 | out: lpBuffer=0x4a8f4640*, lpNumberOfCharsWritten=0x29e9c4*=0x13) returned 1 [0061.342] FindNextFileW (in: hFindFile=0x481288, lpFindFileData=0x4925c4 | out: lpFindFileData=0x4925c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3b9be00, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xc4525480, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xc2889100, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0xbac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.exe", cAlternateFileName="")) returned 0 [0061.343] GetLastError () returned 0x12 [0061.343] FindClose (in: hFindFile=0x481288 | out: hFindFile=0x481288) returned 1 [0061.343] GetProcessHeap () returned 0x480000 [0061.343] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x4925b8 | out: hHeap=0x480000) returned 1 [0061.343] GetProcessHeap () returned 0x480000 [0061.343] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x492558 | out: hHeap=0x480000) returned 1 [0061.343] GetProcessHeap () returned 0x480000 [0061.343] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x493670 | out: hHeap=0x480000) returned 1 [0061.343] GetProcessHeap () returned 0x480000 [0061.343] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x481228 | out: hHeap=0x480000) returned 1 [0061.343] GetProcessHeap () returned 0x480000 [0061.343] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x4922f8 | out: hHeap=0x480000) returned 1 [0061.343] GetProcessHeap () returned 0x480000 [0061.343] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x481010 | out: hHeap=0x480000) returned 1 [0061.343] GetProcessHeap () returned 0x480000 [0061.343] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x480db0 | out: hHeap=0x480000) returned 1 [0061.344] GetProcessHeap () returned 0x480000 [0061.344] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x480a90 | out: hHeap=0x480000) returned 1 [0061.344] GetProcessHeap () returned 0x480000 [0061.344] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48f4a8 | out: hHeap=0x480000) returned 1 [0061.344] GetProcessHeap () returned 0x480000 [0061.344] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x480d48 | out: hHeap=0x480000) returned 1 [0061.344] GetProcessHeap () returned 0x480000 [0061.344] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x480cd8 | out: hHeap=0x480000) returned 1 [0061.344] _get_osfhandle (_FileHandle=1) returned 0x7 [0061.344] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0061.344] _get_osfhandle (_FileHandle=1) returned 0x7 [0061.344] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8e41ac | out: lpMode=0x4a8e41ac) returned 1 [0061.344] _get_osfhandle (_FileHandle=0) returned 0x3 [0061.344] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8e41b0 | out: lpMode=0x4a8e41b0) returned 1 [0061.344] _get_osfhandle (_FileHandle=0) returned 0x3 [0061.344] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0061.345] SetConsoleInputExeNameW () returned 0x1 [0061.345] GetConsoleOutputCP () returned 0x1b5 [0061.345] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a8e4260 | out: lpCPInfo=0x4a8e4260) returned 1 [0061.345] SetThreadUILanguage (LangId=0x0) returned 0x409 [0061.345] exit (_Code=0) Process: id = "8" image_name = "choice.exe" filename = "c:\\windows\\syswow64\\choice.exe" page_root = "0x5e496000" os_pid = "0xb84" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xb6c" cmd_line = "choice /C Y /N /D Y /T 3 " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 93 os_tid = 0xb88 Process: id = "9" image_name = "schtasks.exe" filename = "c:\\windows\\syswow64\\schtasks.exe" page_root = "0x60b48000" os_pid = "0xbc8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb48" cmd_line = "\"schtasks\" /delete /tn \"\" /f" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 109 os_tid = 0xbcc [0058.956] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x28f954 | out: lpSystemTimeAsFileTime=0x28f954*(dwLowDateTime=0xe1b7b880, dwHighDateTime=0x1d531b1)) [0058.956] GetCurrentProcessId () returned 0xbc8 [0058.956] GetCurrentThreadId () returned 0xbcc [0058.957] GetTickCount () returned 0x1d7e7 [0058.957] RtlQueryPerformanceCounter () returned 0x1 [0058.958] GetModuleHandleA (lpModuleName=0x0) returned 0xe80000 [0058.958] __set_app_type (_Type=0x1) [0058.958] __p__fmode () returned 0x74eb31f4 [0058.958] __p__commode () returned 0x74eb31fc [0058.958] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xe97881) returned 0x0 [0058.958] __wgetmainargs (in: _Argc=0xea9e6c, _Argv=0xea9e74, _Env=0xea9e70, _DoWildCard=0, _StartInfo=0xea9e80 | out: _Argc=0xea9e6c, _Argv=0xea9e74, _Env=0xea9e70) returned 0 [0058.959] _onexit (_Func=0xea0fe2) returned 0xea0fe2 [0058.959] _onexit (_Func=0xea0ff3) returned 0xea0ff3 [0058.959] _onexit (_Func=0xea1002) returned 0xea1002 [0058.959] _onexit (_Func=0xea101e) returned 0xea101e [0058.959] _onexit (_Func=0xea103a) returned 0xea103a [0058.959] _onexit (_Func=0xea1056) returned 0xea1056 [0058.959] _onexit (_Func=0xea1072) returned 0xea1072 [0058.959] _onexit (_Func=0xea108e) returned 0xea108e [0058.959] _onexit (_Func=0xea10aa) returned 0xea10aa [0058.959] _onexit (_Func=0xea10c6) returned 0xea10c6 [0058.960] _onexit (_Func=0xea10e2) returned 0xea10e2 [0058.960] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0058.960] WinSqmIsOptedIn () returned 0x0 [0058.960] GetProcessHeap () returned 0x2e0000 [0058.960] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x10) returned 0x2f49f0 [0058.960] SetLastError (dwErrCode=0x0) [0058.960] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0058.960] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0058.960] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0058.960] VerifyVersionInfoW (in: lpVersionInformation=0x28f3cc, dwTypeMask=0x3, dwlConditionMask=0x1801b | out: lpVersionInformation=0x28f3cc) returned 1 [0058.960] GetProcessHeap () returned 0x2e0000 [0058.960] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x10) returned 0x2f4a08 [0058.960] lstrlenW (lpString="") returned 0 [0058.960] GetProcessHeap () returned 0x2e0000 [0058.961] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x2) returned 0x2f4dd8 [0058.961] GetProcessHeap () returned 0x2e0000 [0058.961] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f4de8 [0058.961] GetProcessHeap () returned 0x2e0000 [0058.961] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x10) returned 0x2f4a20 [0058.961] GetProcessHeap () returned 0x2e0000 [0058.961] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f4e08 [0058.961] GetProcessHeap () returned 0x2e0000 [0058.961] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f4e28 [0058.961] GetProcessHeap () returned 0x2e0000 [0058.961] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f4e48 [0058.961] GetProcessHeap () returned 0x2e0000 [0058.961] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f4e68 [0058.961] GetProcessHeap () returned 0x2e0000 [0058.961] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x10) returned 0x2f4a38 [0058.961] GetProcessHeap () returned 0x2e0000 [0058.961] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f4e88 [0058.961] GetProcessHeap () returned 0x2e0000 [0058.961] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f4ea8 [0058.961] GetProcessHeap () returned 0x2e0000 [0058.961] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f4ec8 [0058.961] GetProcessHeap () returned 0x2e0000 [0058.961] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f4ee8 [0058.961] GetProcessHeap () returned 0x2e0000 [0058.961] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x10) returned 0x2f4a50 [0058.961] GetProcessHeap () returned 0x2e0000 [0058.961] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f4f08 [0058.961] GetProcessHeap () returned 0x2e0000 [0058.961] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f4f40 [0058.961] GetProcessHeap () returned 0x2e0000 [0058.961] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f4f60 [0058.961] GetProcessHeap () returned 0x2e0000 [0058.961] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f4f80 [0058.961] SetThreadUILanguage (LangId=0x0) returned 0x409 [0058.962] SetLastError (dwErrCode=0x0) [0058.962] GetProcessHeap () returned 0x2e0000 [0058.962] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f4fa0 [0058.962] GetProcessHeap () returned 0x2e0000 [0058.962] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f4fc0 [0058.962] GetProcessHeap () returned 0x2e0000 [0058.962] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f4fe0 [0058.962] GetProcessHeap () returned 0x2e0000 [0058.962] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f5000 [0058.962] GetProcessHeap () returned 0x2e0000 [0058.962] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f5020 [0058.962] GetProcessHeap () returned 0x2e0000 [0058.962] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x10) returned 0x2f4a68 [0058.962] _memicmp (_Buf1=0x2f4a68, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.962] GetProcessHeap () returned 0x2e0000 [0058.962] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x208) returned 0x2f58a8 [0058.962] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2f58a8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\schtasks.exe" (normalized: "c:\\windows\\syswow64\\schtasks.exe")) returned 0x20 [0058.962] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x74a90000 [0058.963] GetProcAddress (hModule=0x74a90000, lpProcName="GetFileVersionInfoSizeW") returned 0x74a919d9 [0058.964] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0058.964] GetProcessHeap () returned 0x2e0000 [0058.964] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x74e) returned 0x2f5ab8 [0058.964] GetProcAddress (hModule=0x74a90000, lpProcName="GetFileVersionInfoW") returned 0x74a919f4 [0058.964] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x2f5ab8 | out: lpData=0x2f5ab8) returned 1 [0058.964] GetProcAddress (hModule=0x74a90000, lpProcName="VerQueryValueW") returned 0x74a91b51 [0058.964] VerQueryValueW (in: pBlock=0x2f5ab8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x28f4d4, puLen=0x28f4d8 | out: lplpBuffer=0x28f4d4*=0x2f5e54, puLen=0x28f4d8) returned 1 [0058.965] _memicmp (_Buf1=0x2f4a68, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.965] _vsnwprintf (in: _Buffer=0x2f58a8, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x28f4bc | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0058.965] VerQueryValueW (in: pBlock=0x2f5ab8, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x28f4e4, puLen=0x28f4e0 | out: lplpBuffer=0x28f4e4*=0x2f5c80, puLen=0x28f4e0) returned 1 [0058.965] lstrlenW (lpString="schtasks.exe") returned 12 [0058.965] lstrlenW (lpString="schtasks.exe") returned 12 [0058.965] lstrlenW (lpString=".EXE") returned 4 [0058.966] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0058.966] lstrlenW (lpString="schtasks.exe") returned 12 [0058.966] lstrlenW (lpString=".EXE") returned 4 [0058.966] _memicmp (_Buf1=0x2f4a68, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.966] lstrlenW (lpString="schtasks") returned 8 [0058.966] GetProcessHeap () returned 0x2e0000 [0058.966] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f5060 [0058.966] GetProcessHeap () returned 0x2e0000 [0058.966] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f5080 [0058.966] GetProcessHeap () returned 0x2e0000 [0058.966] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f50a0 [0058.966] GetProcessHeap () returned 0x2e0000 [0058.966] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f50c0 [0058.966] GetProcessHeap () returned 0x2e0000 [0058.966] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x10) returned 0x2f4ac8 [0058.966] _memicmp (_Buf1=0x2f4ac8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.967] GetProcessHeap () returned 0x2e0000 [0058.967] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0xa0) returned 0x2f6498 [0058.967] GetProcessHeap () returned 0x2e0000 [0058.967] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f50e0 [0058.967] GetProcessHeap () returned 0x2e0000 [0058.967] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f5100 [0058.967] GetProcessHeap () returned 0x2e0000 [0058.967] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f5120 [0058.967] GetProcessHeap () returned 0x2e0000 [0058.967] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x10) returned 0x2f4ae0 [0058.967] _memicmp (_Buf1=0x2f4ae0, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.967] GetProcessHeap () returned 0x2e0000 [0058.967] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x200) returned 0x2f6540 [0058.967] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2f6540, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0058.967] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0058.967] GetProcessHeap () returned 0x2e0000 [0058.967] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x30) returned 0x2f6748 [0058.967] _vsnwprintf (in: _Buffer=0x2f6498, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x28f4c0 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0058.967] GetProcessHeap () returned 0x2e0000 [0058.967] GetProcessHeap () returned 0x2e0000 [0058.967] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5ab8) returned 1 [0058.967] GetProcessHeap () returned 0x2e0000 [0058.967] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5ab8) returned 0x74e [0058.967] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5ab8 | out: hHeap=0x2e0000) returned 1 [0058.967] SetLastError (dwErrCode=0x0) [0058.967] GetThreadLocale () returned 0x409 [0058.967] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.967] lstrlenW (lpString="?") returned 1 [0058.967] GetThreadLocale () returned 0x409 [0058.967] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.967] lstrlenW (lpString="create") returned 6 [0058.968] GetThreadLocale () returned 0x409 [0058.968] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.968] lstrlenW (lpString="delete") returned 6 [0058.968] GetThreadLocale () returned 0x409 [0058.968] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.968] lstrlenW (lpString="query") returned 5 [0058.968] GetThreadLocale () returned 0x409 [0058.968] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.968] lstrlenW (lpString="change") returned 6 [0058.968] GetThreadLocale () returned 0x409 [0058.968] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.968] lstrlenW (lpString="run") returned 3 [0058.968] GetThreadLocale () returned 0x409 [0058.968] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.968] lstrlenW (lpString="end") returned 3 [0058.968] GetThreadLocale () returned 0x409 [0058.968] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.968] lstrlenW (lpString="showsid") returned 7 [0058.968] GetThreadLocale () returned 0x409 [0058.968] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.968] SetLastError (dwErrCode=0x0) [0058.968] SetLastError (dwErrCode=0x0) [0058.968] lstrlenW (lpString="/delete") returned 7 [0058.968] lstrlenW (lpString="-/") returned 2 [0058.968] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0058.968] lstrlenW (lpString="?") returned 1 [0058.968] lstrlenW (lpString="?") returned 1 [0058.968] GetProcessHeap () returned 0x2e0000 [0058.968] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x10) returned 0x2f4af8 [0058.968] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.968] GetProcessHeap () returned 0x2e0000 [0058.968] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0xa) returned 0x2f4b10 [0058.968] lstrlenW (lpString="delete") returned 6 [0058.968] GetProcessHeap () returned 0x2e0000 [0058.968] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x10) returned 0x2f4b28 [0058.968] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.968] GetProcessHeap () returned 0x2e0000 [0058.968] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f5140 [0058.968] _vsnwprintf (in: _Buffer=0x2f4b10, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|?|") returned 3 [0058.968] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|delete|") returned 8 [0058.969] lstrlenW (lpString="|?|") returned 3 [0058.969] lstrlenW (lpString="|delete|") returned 8 [0058.969] SetLastError (dwErrCode=0x490) [0058.969] lstrlenW (lpString="create") returned 6 [0058.969] lstrlenW (lpString="create") returned 6 [0058.969] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.969] GetProcessHeap () returned 0x2e0000 [0058.969] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4b10) returned 1 [0058.969] GetProcessHeap () returned 0x2e0000 [0058.969] RtlReAllocateHeap (Heap=0x2e0000, Flags=0xc, Ptr=0x2f4b10, Size=0x14) returned 0x2f5160 [0058.969] lstrlenW (lpString="delete") returned 6 [0058.969] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.969] _vsnwprintf (in: _Buffer=0x2f5160, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|create|") returned 8 [0058.969] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|delete|") returned 8 [0058.969] lstrlenW (lpString="|create|") returned 8 [0058.969] lstrlenW (lpString="|delete|") returned 8 [0058.969] StrStrIW (lpFirst="|create|", lpSrch="|delete|") returned 0x0 [0058.969] SetLastError (dwErrCode=0x490) [0058.969] lstrlenW (lpString="delete") returned 6 [0058.969] lstrlenW (lpString="delete") returned 6 [0058.969] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.969] lstrlenW (lpString="delete") returned 6 [0058.969] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.969] _vsnwprintf (in: _Buffer=0x2f5160, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|delete|") returned 8 [0058.969] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|delete|") returned 8 [0058.969] lstrlenW (lpString="|delete|") returned 8 [0058.969] lstrlenW (lpString="|delete|") returned 8 [0058.969] StrStrIW (lpFirst="|delete|", lpSrch="|delete|") returned="|delete|" [0058.969] SetLastError (dwErrCode=0x0) [0058.969] SetLastError (dwErrCode=0x0) [0058.969] SetLastError (dwErrCode=0x0) [0058.969] lstrlenW (lpString="/tn") returned 3 [0058.969] lstrlenW (lpString="-/") returned 2 [0058.969] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0058.969] lstrlenW (lpString="?") returned 1 [0058.969] lstrlenW (lpString="?") returned 1 [0058.969] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.970] lstrlenW (lpString="tn") returned 2 [0058.970] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.970] _vsnwprintf (in: _Buffer=0x2f5160, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|?|") returned 3 [0058.970] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|tn|") returned 4 [0058.970] lstrlenW (lpString="|?|") returned 3 [0058.970] lstrlenW (lpString="|tn|") returned 4 [0058.970] SetLastError (dwErrCode=0x490) [0058.970] lstrlenW (lpString="create") returned 6 [0058.970] lstrlenW (lpString="create") returned 6 [0058.970] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.970] lstrlenW (lpString="tn") returned 2 [0058.970] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.970] _vsnwprintf (in: _Buffer=0x2f5160, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|create|") returned 8 [0058.970] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|tn|") returned 4 [0058.970] lstrlenW (lpString="|create|") returned 8 [0058.970] lstrlenW (lpString="|tn|") returned 4 [0058.970] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0058.970] SetLastError (dwErrCode=0x490) [0058.970] lstrlenW (lpString="delete") returned 6 [0058.970] lstrlenW (lpString="delete") returned 6 [0058.970] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.970] lstrlenW (lpString="tn") returned 2 [0058.970] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.970] _vsnwprintf (in: _Buffer=0x2f5160, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|delete|") returned 8 [0058.970] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|tn|") returned 4 [0058.970] lstrlenW (lpString="|delete|") returned 8 [0058.970] lstrlenW (lpString="|tn|") returned 4 [0058.970] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0058.970] SetLastError (dwErrCode=0x490) [0058.970] lstrlenW (lpString="query") returned 5 [0058.970] lstrlenW (lpString="query") returned 5 [0058.970] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.970] lstrlenW (lpString="tn") returned 2 [0058.970] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.971] _vsnwprintf (in: _Buffer=0x2f5160, _BufferCount=0x8, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|query|") returned 7 [0058.971] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|tn|") returned 4 [0058.971] lstrlenW (lpString="|query|") returned 7 [0058.971] lstrlenW (lpString="|tn|") returned 4 [0058.971] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0058.971] SetLastError (dwErrCode=0x490) [0058.971] lstrlenW (lpString="change") returned 6 [0058.971] lstrlenW (lpString="change") returned 6 [0058.971] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.971] lstrlenW (lpString="tn") returned 2 [0058.971] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.971] _vsnwprintf (in: _Buffer=0x2f5160, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|change|") returned 8 [0058.971] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|tn|") returned 4 [0058.971] lstrlenW (lpString="|change|") returned 8 [0058.971] lstrlenW (lpString="|tn|") returned 4 [0058.971] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0058.971] SetLastError (dwErrCode=0x490) [0058.971] lstrlenW (lpString="run") returned 3 [0058.971] lstrlenW (lpString="run") returned 3 [0058.971] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.971] lstrlenW (lpString="tn") returned 2 [0058.971] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.971] _vsnwprintf (in: _Buffer=0x2f5160, _BufferCount=0x6, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|run|") returned 5 [0058.971] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|tn|") returned 4 [0058.971] lstrlenW (lpString="|run|") returned 5 [0058.971] lstrlenW (lpString="|tn|") returned 4 [0058.971] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0058.971] SetLastError (dwErrCode=0x490) [0058.971] lstrlenW (lpString="end") returned 3 [0058.971] lstrlenW (lpString="end") returned 3 [0058.971] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.971] lstrlenW (lpString="tn") returned 2 [0058.971] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.971] _vsnwprintf (in: _Buffer=0x2f5160, _BufferCount=0x6, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|end|") returned 5 [0058.972] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|tn|") returned 4 [0058.972] lstrlenW (lpString="|end|") returned 5 [0058.972] lstrlenW (lpString="|tn|") returned 4 [0058.972] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0058.972] SetLastError (dwErrCode=0x490) [0058.972] lstrlenW (lpString="showsid") returned 7 [0058.972] lstrlenW (lpString="showsid") returned 7 [0058.972] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.972] GetProcessHeap () returned 0x2e0000 [0058.972] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5160) returned 1 [0058.972] GetProcessHeap () returned 0x2e0000 [0058.972] RtlReAllocateHeap (Heap=0x2e0000, Flags=0xc, Ptr=0x2f5160, Size=0x16) returned 0x2f5180 [0058.972] lstrlenW (lpString="tn") returned 2 [0058.972] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.972] _vsnwprintf (in: _Buffer=0x2f5180, _BufferCount=0xa, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|showsid|") returned 9 [0058.972] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|tn|") returned 4 [0058.972] lstrlenW (lpString="|showsid|") returned 9 [0058.972] lstrlenW (lpString="|tn|") returned 4 [0058.972] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0058.972] SetLastError (dwErrCode=0x490) [0058.974] SetLastError (dwErrCode=0x490) [0058.974] SetLastError (dwErrCode=0x0) [0058.975] lstrlenW (lpString="/tn") returned 3 [0058.975] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0058.975] SetLastError (dwErrCode=0x490) [0058.975] SetLastError (dwErrCode=0x0) [0058.975] lstrlenW (lpString="/tn") returned 3 [0058.975] GetProcessHeap () returned 0x2e0000 [0058.975] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x8) returned 0x2f5ab8 [0058.975] GetProcessHeap () returned 0x2e0000 [0058.975] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f5160 [0058.975] SetLastError (dwErrCode=0x0) [0058.975] SetLastError (dwErrCode=0x0) [0058.975] lstrlenW (lpString="") returned 0 [0058.975] SetLastError (dwErrCode=0x490) [0058.975] SetLastError (dwErrCode=0x0) [0058.975] lstrlenW (lpString="") returned 0 [0058.975] SetLastError (dwErrCode=0x490) [0058.975] SetLastError (dwErrCode=0x0) [0058.975] lstrlenW (lpString="") returned 0 [0058.975] GetProcessHeap () returned 0x2e0000 [0058.975] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x2) returned 0x2f5ac8 [0058.975] GetProcessHeap () returned 0x2e0000 [0058.975] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f51a0 [0058.975] SetLastError (dwErrCode=0x0) [0058.975] SetLastError (dwErrCode=0x0) [0058.975] lstrlenW (lpString="/f") returned 2 [0058.975] lstrlenW (lpString="-/") returned 2 [0058.975] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0058.975] lstrlenW (lpString="?") returned 1 [0058.975] lstrlenW (lpString="?") returned 1 [0058.975] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.975] lstrlenW (lpString="f") returned 1 [0058.975] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.975] _vsnwprintf (in: _Buffer=0x2f5180, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|?|") returned 3 [0058.975] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|f|") returned 3 [0058.975] lstrlenW (lpString="|?|") returned 3 [0058.975] lstrlenW (lpString="|f|") returned 3 [0058.975] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0058.975] SetLastError (dwErrCode=0x490) [0058.975] lstrlenW (lpString="create") returned 6 [0058.976] lstrlenW (lpString="create") returned 6 [0058.976] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.976] lstrlenW (lpString="f") returned 1 [0058.976] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.976] _vsnwprintf (in: _Buffer=0x2f5180, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|create|") returned 8 [0058.976] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|f|") returned 3 [0058.976] lstrlenW (lpString="|create|") returned 8 [0058.976] lstrlenW (lpString="|f|") returned 3 [0058.976] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0058.976] SetLastError (dwErrCode=0x490) [0058.976] lstrlenW (lpString="delete") returned 6 [0058.976] lstrlenW (lpString="delete") returned 6 [0058.976] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.976] lstrlenW (lpString="f") returned 1 [0058.976] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.976] _vsnwprintf (in: _Buffer=0x2f5180, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|delete|") returned 8 [0058.976] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|f|") returned 3 [0058.976] lstrlenW (lpString="|delete|") returned 8 [0058.976] lstrlenW (lpString="|f|") returned 3 [0058.976] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0058.976] SetLastError (dwErrCode=0x490) [0058.976] lstrlenW (lpString="query") returned 5 [0058.976] lstrlenW (lpString="query") returned 5 [0058.976] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.976] lstrlenW (lpString="f") returned 1 [0058.976] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.976] _vsnwprintf (in: _Buffer=0x2f5180, _BufferCount=0x8, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|query|") returned 7 [0058.976] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|f|") returned 3 [0058.976] lstrlenW (lpString="|query|") returned 7 [0058.976] lstrlenW (lpString="|f|") returned 3 [0058.976] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0058.976] SetLastError (dwErrCode=0x490) [0058.976] lstrlenW (lpString="change") returned 6 [0058.976] lstrlenW (lpString="change") returned 6 [0058.976] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.977] lstrlenW (lpString="f") returned 1 [0058.977] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.977] _vsnwprintf (in: _Buffer=0x2f5180, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|change|") returned 8 [0058.977] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|f|") returned 3 [0058.977] lstrlenW (lpString="|change|") returned 8 [0058.977] lstrlenW (lpString="|f|") returned 3 [0058.977] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0058.977] SetLastError (dwErrCode=0x490) [0058.977] lstrlenW (lpString="run") returned 3 [0058.977] lstrlenW (lpString="run") returned 3 [0058.977] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.977] lstrlenW (lpString="f") returned 1 [0058.977] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.977] _vsnwprintf (in: _Buffer=0x2f5180, _BufferCount=0x6, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|run|") returned 5 [0058.977] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|f|") returned 3 [0058.977] lstrlenW (lpString="|run|") returned 5 [0058.977] lstrlenW (lpString="|f|") returned 3 [0058.977] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0058.977] SetLastError (dwErrCode=0x490) [0058.977] lstrlenW (lpString="end") returned 3 [0058.977] lstrlenW (lpString="end") returned 3 [0058.977] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.977] lstrlenW (lpString="f") returned 1 [0058.977] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.977] _vsnwprintf (in: _Buffer=0x2f5180, _BufferCount=0x6, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|end|") returned 5 [0058.977] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|f|") returned 3 [0058.977] lstrlenW (lpString="|end|") returned 5 [0058.977] lstrlenW (lpString="|f|") returned 3 [0058.977] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0058.977] SetLastError (dwErrCode=0x490) [0058.977] lstrlenW (lpString="showsid") returned 7 [0058.977] lstrlenW (lpString="showsid") returned 7 [0058.977] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.977] lstrlenW (lpString="f") returned 1 [0058.977] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.978] _vsnwprintf (in: _Buffer=0x2f5180, _BufferCount=0xa, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|showsid|") returned 9 [0058.978] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28f4a8 | out: _Buffer="|f|") returned 3 [0058.978] lstrlenW (lpString="|showsid|") returned 9 [0058.978] lstrlenW (lpString="|f|") returned 3 [0058.978] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0058.978] SetLastError (dwErrCode=0x490) [0058.978] SetLastError (dwErrCode=0x490) [0058.978] SetLastError (dwErrCode=0x0) [0058.978] lstrlenW (lpString="/f") returned 2 [0058.978] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0058.978] SetLastError (dwErrCode=0x490) [0058.978] SetLastError (dwErrCode=0x0) [0058.978] lstrlenW (lpString="/f") returned 2 [0058.978] GetProcessHeap () returned 0x2e0000 [0058.978] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x6) returned 0x2f5ad8 [0058.978] GetProcessHeap () returned 0x2e0000 [0058.978] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f51c0 [0058.978] SetLastError (dwErrCode=0x0) [0058.978] GetProcessHeap () returned 0x2e0000 [0058.978] GetProcessHeap () returned 0x2e0000 [0058.978] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5ab8) returned 1 [0058.978] GetProcessHeap () returned 0x2e0000 [0058.978] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5ab8) returned 0x8 [0058.978] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5ab8 | out: hHeap=0x2e0000) returned 1 [0058.978] GetProcessHeap () returned 0x2e0000 [0058.978] GetProcessHeap () returned 0x2e0000 [0058.978] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5160) returned 1 [0058.978] GetProcessHeap () returned 0x2e0000 [0058.978] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5160) returned 0x14 [0058.978] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5160 | out: hHeap=0x2e0000) returned 1 [0058.978] GetProcessHeap () returned 0x2e0000 [0058.978] GetProcessHeap () returned 0x2e0000 [0058.978] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5ac8) returned 1 [0058.978] GetProcessHeap () returned 0x2e0000 [0058.978] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5ac8) returned 0x2 [0058.978] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5ac8 | out: hHeap=0x2e0000) returned 1 [0058.978] GetProcessHeap () returned 0x2e0000 [0058.978] GetProcessHeap () returned 0x2e0000 [0058.978] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f51a0) returned 1 [0058.978] GetProcessHeap () returned 0x2e0000 [0058.979] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f51a0) returned 0x14 [0058.979] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f51a0 | out: hHeap=0x2e0000) returned 1 [0058.979] GetProcessHeap () returned 0x2e0000 [0058.979] GetProcessHeap () returned 0x2e0000 [0058.979] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5ad8) returned 1 [0058.979] GetProcessHeap () returned 0x2e0000 [0058.979] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5ad8) returned 0x6 [0058.979] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5ad8 | out: hHeap=0x2e0000) returned 1 [0058.979] GetProcessHeap () returned 0x2e0000 [0058.979] GetProcessHeap () returned 0x2e0000 [0058.979] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f51c0) returned 1 [0058.979] GetProcessHeap () returned 0x2e0000 [0058.979] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f51c0) returned 0x14 [0058.979] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f51c0 | out: hHeap=0x2e0000) returned 1 [0058.979] GetProcessHeap () returned 0x2e0000 [0058.979] GetProcessHeap () returned 0x2e0000 [0058.979] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f49f0) returned 1 [0058.979] GetProcessHeap () returned 0x2e0000 [0058.979] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f49f0) returned 0x10 [0058.979] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f49f0 | out: hHeap=0x2e0000) returned 1 [0058.979] SetLastError (dwErrCode=0x0) [0058.979] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0058.979] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0058.979] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0058.979] VerifyVersionInfoW (in: lpVersionInformation=0x28f2e4, dwTypeMask=0x3, dwlConditionMask=0x1801b | out: lpVersionInformation=0x28f2e4) returned 1 [0058.979] SetLastError (dwErrCode=0x0) [0058.979] lstrlenW (lpString="delete") returned 6 [0058.979] StrChrIW (lpStart="delete", wMatch=0x7c) returned 0x0 [0058.979] SetLastError (dwErrCode=0x490) [0058.979] SetLastError (dwErrCode=0x0) [0058.979] lstrlenW (lpString="delete") returned 6 [0058.979] GetProcessHeap () returned 0x2e0000 [0058.979] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f51c0 [0058.979] GetProcessHeap () returned 0x2e0000 [0058.979] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x10) returned 0x2f49f0 [0058.980] _memicmp (_Buf1=0x2f49f0, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.980] GetProcessHeap () returned 0x2e0000 [0058.980] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x16) returned 0x2f51a0 [0058.980] SetLastError (dwErrCode=0x0) [0058.980] _memicmp (_Buf1=0x2f4a68, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.980] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2f58a8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\schtasks.exe" (normalized: "c:\\windows\\syswow64\\schtasks.exe")) returned 0x20 [0058.980] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0058.980] GetProcessHeap () returned 0x2e0000 [0058.980] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x74e) returned 0x2f5ab8 [0058.980] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x2f5ab8 | out: lpData=0x2f5ab8) returned 1 [0058.980] VerQueryValueW (in: pBlock=0x2f5ab8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x28f3ec, puLen=0x28f3f0 | out: lplpBuffer=0x28f3ec*=0x2f5e54, puLen=0x28f3f0) returned 1 [0058.980] _memicmp (_Buf1=0x2f4a68, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.980] _vsnwprintf (in: _Buffer=0x2f58a8, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x28f3d4 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0058.980] VerQueryValueW (in: pBlock=0x2f5ab8, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x28f3fc, puLen=0x28f3f8 | out: lplpBuffer=0x28f3fc*=0x2f5c80, puLen=0x28f3f8) returned 1 [0058.980] lstrlenW (lpString="schtasks.exe") returned 12 [0058.980] lstrlenW (lpString="schtasks.exe") returned 12 [0058.980] lstrlenW (lpString=".EXE") returned 4 [0058.980] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0058.980] lstrlenW (lpString="schtasks.exe") returned 12 [0058.980] lstrlenW (lpString=".EXE") returned 4 [0058.980] lstrlenW (lpString="schtasks") returned 8 [0058.980] lstrlenW (lpString="/delete") returned 7 [0058.980] _memicmp (_Buf1=0x2f4a68, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.980] _vsnwprintf (in: _Buffer=0x2f58a8, _BufferCount=0x19, _Format="%s %s", _ArgList=0x28f3d4 | out: _Buffer="schtasks /delete") returned 16 [0058.980] _memicmp (_Buf1=0x2f4ac8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.981] GetProcessHeap () returned 0x2e0000 [0058.981] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f5160 [0058.981] _memicmp (_Buf1=0x2f4ae0, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.981] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2f6540, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0058.981] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0058.981] GetProcessHeap () returned 0x2e0000 [0058.981] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x30) returned 0x2f6780 [0058.981] _vsnwprintf (in: _Buffer=0x2f6498, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x28f3d8 | out: _Buffer="Type \"SCHTASKS /DELETE /?\" for usage.") returned 37 [0058.981] GetProcessHeap () returned 0x2e0000 [0058.981] GetProcessHeap () returned 0x2e0000 [0058.981] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5ab8) returned 1 [0058.981] GetProcessHeap () returned 0x2e0000 [0058.981] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5ab8) returned 0x74e [0058.981] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5ab8 | out: hHeap=0x2e0000) returned 1 [0058.981] SetLastError (dwErrCode=0x0) [0058.981] GetThreadLocale () returned 0x409 [0058.981] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.981] lstrlenW (lpString="delete") returned 6 [0058.981] GetThreadLocale () returned 0x409 [0058.981] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.981] lstrlenW (lpString="?") returned 1 [0058.981] GetThreadLocale () returned 0x409 [0058.981] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.981] lstrlenW (lpString="s") returned 1 [0058.981] GetThreadLocale () returned 0x409 [0058.981] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.981] lstrlenW (lpString="u") returned 1 [0058.981] GetThreadLocale () returned 0x409 [0058.981] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.981] lstrlenW (lpString="p") returned 1 [0058.981] GetThreadLocale () returned 0x409 [0058.981] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.981] lstrlenW (lpString="tn") returned 2 [0058.981] GetThreadLocale () returned 0x409 [0058.981] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0058.981] lstrlenW (lpString="f") returned 1 [0058.981] SetLastError (dwErrCode=0x0) [0058.981] SetLastError (dwErrCode=0x0) [0058.981] lstrlenW (lpString="/delete") returned 7 [0058.982] lstrlenW (lpString="-/") returned 2 [0058.982] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0058.982] lstrlenW (lpString="delete") returned 6 [0058.982] lstrlenW (lpString="delete") returned 6 [0058.982] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.982] lstrlenW (lpString="delete") returned 6 [0058.982] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.982] _vsnwprintf (in: _Buffer=0x2f5180, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|delete|") returned 8 [0058.982] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|delete|") returned 8 [0058.982] lstrlenW (lpString="|delete|") returned 8 [0058.982] lstrlenW (lpString="|delete|") returned 8 [0058.982] StrStrIW (lpFirst="|delete|", lpSrch="|delete|") returned="|delete|" [0058.982] SetLastError (dwErrCode=0x0) [0058.982] SetLastError (dwErrCode=0x0) [0058.982] SetLastError (dwErrCode=0x0) [0058.982] lstrlenW (lpString="/tn") returned 3 [0058.982] lstrlenW (lpString="-/") returned 2 [0058.982] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0058.982] lstrlenW (lpString="delete") returned 6 [0058.982] lstrlenW (lpString="delete") returned 6 [0058.982] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.982] lstrlenW (lpString="tn") returned 2 [0058.982] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.982] _vsnwprintf (in: _Buffer=0x2f5180, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|delete|") returned 8 [0058.982] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|tn|") returned 4 [0058.982] lstrlenW (lpString="|delete|") returned 8 [0058.982] lstrlenW (lpString="|tn|") returned 4 [0058.982] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0058.982] SetLastError (dwErrCode=0x490) [0058.982] lstrlenW (lpString="?") returned 1 [0058.982] lstrlenW (lpString="?") returned 1 [0058.982] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.982] lstrlenW (lpString="tn") returned 2 [0058.982] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.982] _vsnwprintf (in: _Buffer=0x2f5180, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|?|") returned 3 [0058.983] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|tn|") returned 4 [0058.983] lstrlenW (lpString="|?|") returned 3 [0058.983] lstrlenW (lpString="|tn|") returned 4 [0058.983] SetLastError (dwErrCode=0x490) [0058.983] lstrlenW (lpString="s") returned 1 [0058.983] lstrlenW (lpString="s") returned 1 [0058.983] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.983] lstrlenW (lpString="tn") returned 2 [0058.983] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.983] _vsnwprintf (in: _Buffer=0x2f5180, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|s|") returned 3 [0058.983] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|tn|") returned 4 [0058.983] lstrlenW (lpString="|s|") returned 3 [0058.983] lstrlenW (lpString="|tn|") returned 4 [0058.983] SetLastError (dwErrCode=0x490) [0058.983] lstrlenW (lpString="u") returned 1 [0058.983] lstrlenW (lpString="u") returned 1 [0058.983] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.983] lstrlenW (lpString="tn") returned 2 [0058.983] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.983] _vsnwprintf (in: _Buffer=0x2f5180, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|u|") returned 3 [0058.983] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|tn|") returned 4 [0058.983] lstrlenW (lpString="|u|") returned 3 [0058.983] lstrlenW (lpString="|tn|") returned 4 [0058.983] SetLastError (dwErrCode=0x490) [0058.983] lstrlenW (lpString="p") returned 1 [0058.983] lstrlenW (lpString="p") returned 1 [0058.983] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.983] lstrlenW (lpString="tn") returned 2 [0058.983] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.983] _vsnwprintf (in: _Buffer=0x2f5180, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|p|") returned 3 [0058.983] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|tn|") returned 4 [0058.983] lstrlenW (lpString="|p|") returned 3 [0058.983] lstrlenW (lpString="|tn|") returned 4 [0058.983] SetLastError (dwErrCode=0x490) [0058.983] lstrlenW (lpString="tn") returned 2 [0058.984] lstrlenW (lpString="tn") returned 2 [0058.984] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.984] lstrlenW (lpString="tn") returned 2 [0058.984] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.984] _vsnwprintf (in: _Buffer=0x2f5180, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|tn|") returned 4 [0058.984] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|tn|") returned 4 [0058.984] lstrlenW (lpString="|tn|") returned 4 [0058.984] lstrlenW (lpString="|tn|") returned 4 [0058.984] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0058.984] SetLastError (dwErrCode=0x0) [0058.984] SetLastError (dwErrCode=0x0) [0058.984] lstrlenW (lpString="") returned 0 [0058.984] SetLastError (dwErrCode=0x490) [0058.984] SetLastError (dwErrCode=0x0) [0058.984] lstrlenW (lpString="") returned 0 [0058.984] SetLastError (dwErrCode=0x490) [0058.984] SetLastError (dwErrCode=0x0) [0058.984] lstrlenW (lpString="") returned 0 [0058.984] SetLastError (dwErrCode=0x0) [0058.984] SetLastError (dwErrCode=0x0) [0058.984] lstrlenW (lpString="/f") returned 2 [0058.984] lstrlenW (lpString="-/") returned 2 [0058.984] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0058.984] lstrlenW (lpString="delete") returned 6 [0058.984] lstrlenW (lpString="delete") returned 6 [0058.984] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.984] lstrlenW (lpString="f") returned 1 [0058.984] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.984] _vsnwprintf (in: _Buffer=0x2f5180, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|delete|") returned 8 [0058.984] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|f|") returned 3 [0058.984] lstrlenW (lpString="|delete|") returned 8 [0058.984] lstrlenW (lpString="|f|") returned 3 [0058.984] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0058.984] SetLastError (dwErrCode=0x490) [0058.984] lstrlenW (lpString="?") returned 1 [0058.984] lstrlenW (lpString="?") returned 1 [0058.984] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.985] lstrlenW (lpString="f") returned 1 [0058.985] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.985] _vsnwprintf (in: _Buffer=0x2f5180, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|?|") returned 3 [0058.985] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|f|") returned 3 [0058.985] lstrlenW (lpString="|?|") returned 3 [0058.985] lstrlenW (lpString="|f|") returned 3 [0058.985] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0058.985] SetLastError (dwErrCode=0x490) [0058.985] lstrlenW (lpString="s") returned 1 [0058.985] lstrlenW (lpString="s") returned 1 [0058.985] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.985] lstrlenW (lpString="f") returned 1 [0058.985] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.985] _vsnwprintf (in: _Buffer=0x2f5180, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|s|") returned 3 [0058.985] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|f|") returned 3 [0058.985] lstrlenW (lpString="|s|") returned 3 [0058.985] lstrlenW (lpString="|f|") returned 3 [0058.985] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0058.985] SetLastError (dwErrCode=0x490) [0058.985] lstrlenW (lpString="u") returned 1 [0058.985] lstrlenW (lpString="u") returned 1 [0058.985] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.985] lstrlenW (lpString="f") returned 1 [0058.985] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.985] _vsnwprintf (in: _Buffer=0x2f5180, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|u|") returned 3 [0058.985] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|f|") returned 3 [0058.985] lstrlenW (lpString="|u|") returned 3 [0058.985] lstrlenW (lpString="|f|") returned 3 [0058.985] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0058.985] SetLastError (dwErrCode=0x490) [0058.985] lstrlenW (lpString="p") returned 1 [0058.985] lstrlenW (lpString="p") returned 1 [0058.985] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.985] lstrlenW (lpString="f") returned 1 [0058.985] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.985] _vsnwprintf (in: _Buffer=0x2f5180, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|p|") returned 3 [0058.986] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|f|") returned 3 [0058.986] lstrlenW (lpString="|p|") returned 3 [0058.986] lstrlenW (lpString="|f|") returned 3 [0058.986] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0058.986] SetLastError (dwErrCode=0x490) [0058.986] lstrlenW (lpString="tn") returned 2 [0058.986] lstrlenW (lpString="tn") returned 2 [0058.986] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.986] lstrlenW (lpString="f") returned 1 [0058.986] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.986] _vsnwprintf (in: _Buffer=0x2f5180, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|tn|") returned 4 [0058.986] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|f|") returned 3 [0058.986] lstrlenW (lpString="|tn|") returned 4 [0058.986] lstrlenW (lpString="|f|") returned 3 [0058.986] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0058.986] SetLastError (dwErrCode=0x490) [0058.986] lstrlenW (lpString="f") returned 1 [0058.986] lstrlenW (lpString="f") returned 1 [0058.986] _memicmp (_Buf1=0x2f4af8, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.986] lstrlenW (lpString="f") returned 1 [0058.986] _memicmp (_Buf1=0x2f4b28, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0058.986] _vsnwprintf (in: _Buffer=0x2f5180, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|f|") returned 3 [0058.986] _vsnwprintf (in: _Buffer=0x2f5140, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28f3c0 | out: _Buffer="|f|") returned 3 [0058.986] lstrlenW (lpString="|f|") returned 3 [0058.986] lstrlenW (lpString="|f|") returned 3 [0058.986] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0058.986] SetLastError (dwErrCode=0x0) [0058.986] SetLastError (dwErrCode=0x0) [0058.986] lstrlenW (lpString="") returned 0 [0058.986] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0058.999] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0059.017] CoCreateInstance (in: rclsid=0xe8230c*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xe820fc*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x28ee18 | out: ppv=0x28ee18*=0x463c28) returned 0x0 [0059.147] TaskScheduler:ITaskService:Connect (This=0x463c28, serverName=0x28ed88*(varType=0x8, wReserved1=0x1, wReserved2=0x1000, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x28ed98*(varType=0x0, wReserved1=0x1, wReserved2=0x68, wReserved3=0x0, varVal1=0x28f3d0, varVal2=0x28f050), domain=0x28eda8*(varType=0x0, wReserved1=0x28, wReserved2=0x9cde, wReserved3=0x74e1, varVal1=0x28f050, varVal2=0x0), password=0x28edb8*(varType=0x0, wReserved1=0x28, wReserved2=0x9c39, wReserved3=0x74e1, varVal1=0x28f050, varVal2=0x380)) returned 0x0 [0059.155] TaskScheduler:IUnknown:AddRef (This=0x463c28) returned 0x2 [0059.155] TaskScheduler:ITaskService:GetFolder (in: This=0x463c28, Path=0x0, ppFolder=0x28ee5c | out: ppFolder=0x28ee5c*=0x463c90) returned 0x0 [0059.158] GetProcessHeap () returned 0x2e0000 [0059.158] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x10) returned 0x300f50 [0059.158] GetThreadLocale () returned 0x409 [0059.158] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="", cchCount1=-1, lpString2="*", cchCount2=-1) returned 1 [0059.158] ITaskFolder:GetTask (in: This=0x463c90, Path="", ppTask=0x28ee04 | out: ppTask=0x28ee04*=0x0) returned 0x80070057 [0059.158] SetLastError (dwErrCode=0x80070057) [0059.158] GetThreadLocale () returned 0x409 [0059.158] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="", cchCount1=-1, lpString2="*", cchCount2=-1) returned 1 [0059.158] GetProcessHeap () returned 0x2e0000 [0059.158] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x14) returned 0x2f5580 [0059.158] _memicmp (_Buf1=0x2f4ae0, _Buf2=0xe81ed8, _Size=0x7) returned 0 [0059.158] LoadStringW (in: hInstance=0x0, uID=0x7a, lpBuffer=0x2f6540, cchBufferMax=256 | out: lpBuffer="ERROR: The specified task name \"%s\" does not exist in the system.\n") returned 0x42 [0059.158] lstrlenW (lpString="ERROR: The specified task name \"%s\" does not exist in the system.\n") returned 66 [0059.158] GetProcessHeap () returned 0x2e0000 [0059.158] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0xc, Size=0x86) returned 0x304438 [0059.158] _vsnwprintf (in: _Buffer=0x28f040, _BufferCount=0x1fb, _Format="ERROR: The specified task name \"%s\" does not exist in the system.\n", _ArgList=0x28ee3c | out: _Buffer="ERROR: The specified task name \"\" does not exist in the system.\n") returned 64 [0059.158] _fileno (_File=0x74eb2940) returned 2 [0059.158] _errno () returned 0x4607d8 [0059.159] _get_osfhandle (_FileHandle=2) returned 0xb [0059.159] _errno () returned 0x4607d8 [0059.159] GetFileType (hFile=0xb) returned 0x2 [0059.159] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0059.159] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x28ee00 | out: lpMode=0x28ee00) returned 1 [0059.159] __iob_func () returned 0x74eb2900 [0059.159] __iob_func () returned 0x74eb2900 [0059.159] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0059.159] lstrlenW (lpString="ERROR: The specified task name \"\" does not exist in the system.\n") returned 64 [0059.159] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x28f040*, nNumberOfCharsToWrite=0x40, lpNumberOfCharsWritten=0x28ee28, lpReserved=0x0 | out: lpBuffer=0x28f040*, lpNumberOfCharsWritten=0x28ee28*=0x40) returned 1 [0059.160] TaskScheduler:IUnknown:Release (This=0x463c90) returned 0x0 [0059.160] TaskScheduler:IUnknown:Release (This=0x463c28) returned 0x1 [0059.160] GetProcessHeap () returned 0x2e0000 [0059.160] GetProcessHeap () returned 0x2e0000 [0059.160] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f51a0) returned 1 [0059.160] GetProcessHeap () returned 0x2e0000 [0059.160] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f51a0) returned 0x16 [0059.160] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f51a0 | out: hHeap=0x2e0000) returned 1 [0059.160] GetProcessHeap () returned 0x2e0000 [0059.160] GetProcessHeap () returned 0x2e0000 [0059.160] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f49f0) returned 1 [0059.160] GetProcessHeap () returned 0x2e0000 [0059.160] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f49f0) returned 0x10 [0059.160] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f49f0 | out: hHeap=0x2e0000) returned 1 [0059.160] GetProcessHeap () returned 0x2e0000 [0059.160] GetProcessHeap () returned 0x2e0000 [0059.160] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f51c0) returned 1 [0059.160] GetProcessHeap () returned 0x2e0000 [0059.160] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f51c0) returned 0x14 [0059.160] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f51c0 | out: hHeap=0x2e0000) returned 1 [0059.160] GetProcessHeap () returned 0x2e0000 [0059.160] GetProcessHeap () returned 0x2e0000 [0059.160] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f6498) returned 1 [0059.160] GetProcessHeap () returned 0x2e0000 [0059.160] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f6498) returned 0xa0 [0059.160] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f6498 | out: hHeap=0x2e0000) returned 1 [0059.160] GetProcessHeap () returned 0x2e0000 [0059.160] GetProcessHeap () returned 0x2e0000 [0059.160] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4ac8) returned 1 [0059.160] GetProcessHeap () returned 0x2e0000 [0059.160] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f4ac8) returned 0x10 [0059.160] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4ac8 | out: hHeap=0x2e0000) returned 1 [0059.160] GetProcessHeap () returned 0x2e0000 [0059.160] GetProcessHeap () returned 0x2e0000 [0059.160] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f50c0) returned 1 [0059.161] GetProcessHeap () returned 0x2e0000 [0059.161] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f50c0) returned 0x14 [0059.161] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f50c0 | out: hHeap=0x2e0000) returned 1 [0059.161] GetProcessHeap () returned 0x2e0000 [0059.161] GetProcessHeap () returned 0x2e0000 [0059.161] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f58a8) returned 1 [0059.161] GetProcessHeap () returned 0x2e0000 [0059.161] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f58a8) returned 0x208 [0059.161] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f58a8 | out: hHeap=0x2e0000) returned 1 [0059.161] GetProcessHeap () returned 0x2e0000 [0059.161] GetProcessHeap () returned 0x2e0000 [0059.161] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4a68) returned 1 [0059.161] GetProcessHeap () returned 0x2e0000 [0059.161] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f4a68) returned 0x10 [0059.161] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4a68 | out: hHeap=0x2e0000) returned 1 [0059.161] GetProcessHeap () returned 0x2e0000 [0059.161] GetProcessHeap () returned 0x2e0000 [0059.161] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5020) returned 1 [0059.161] GetProcessHeap () returned 0x2e0000 [0059.161] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5020) returned 0x14 [0059.161] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5020 | out: hHeap=0x2e0000) returned 1 [0059.161] GetProcessHeap () returned 0x2e0000 [0059.161] GetProcessHeap () returned 0x2e0000 [0059.161] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f6540) returned 1 [0059.161] GetProcessHeap () returned 0x2e0000 [0059.161] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f6540) returned 0x200 [0059.161] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f6540 | out: hHeap=0x2e0000) returned 1 [0059.161] GetProcessHeap () returned 0x2e0000 [0059.161] GetProcessHeap () returned 0x2e0000 [0059.161] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4ae0) returned 1 [0059.161] GetProcessHeap () returned 0x2e0000 [0059.161] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f4ae0) returned 0x10 [0059.161] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4ae0 | out: hHeap=0x2e0000) returned 1 [0059.161] GetProcessHeap () returned 0x2e0000 [0059.161] GetProcessHeap () returned 0x2e0000 [0059.161] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4fc0) returned 1 [0059.161] GetProcessHeap () returned 0x2e0000 [0059.161] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f4fc0) returned 0x14 [0059.162] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4fc0 | out: hHeap=0x2e0000) returned 1 [0059.162] GetProcessHeap () returned 0x2e0000 [0059.162] GetProcessHeap () returned 0x2e0000 [0059.162] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5140) returned 1 [0059.162] GetProcessHeap () returned 0x2e0000 [0059.162] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5140) returned 0x14 [0059.162] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5140 | out: hHeap=0x2e0000) returned 1 [0059.162] GetProcessHeap () returned 0x2e0000 [0059.162] GetProcessHeap () returned 0x2e0000 [0059.162] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4b28) returned 1 [0059.162] GetProcessHeap () returned 0x2e0000 [0059.162] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f4b28) returned 0x10 [0059.162] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4b28 | out: hHeap=0x2e0000) returned 1 [0059.162] GetProcessHeap () returned 0x2e0000 [0059.162] GetProcessHeap () returned 0x2e0000 [0059.162] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4f40) returned 1 [0059.162] GetProcessHeap () returned 0x2e0000 [0059.162] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f4f40) returned 0x14 [0059.162] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4f40 | out: hHeap=0x2e0000) returned 1 [0059.162] GetProcessHeap () returned 0x2e0000 [0059.162] GetProcessHeap () returned 0x2e0000 [0059.162] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5180) returned 1 [0059.162] GetProcessHeap () returned 0x2e0000 [0059.162] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5180) returned 0x16 [0059.162] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5180 | out: hHeap=0x2e0000) returned 1 [0059.162] GetProcessHeap () returned 0x2e0000 [0059.162] GetProcessHeap () returned 0x2e0000 [0059.162] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4af8) returned 1 [0059.162] GetProcessHeap () returned 0x2e0000 [0059.162] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f4af8) returned 0x10 [0059.162] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4af8 | out: hHeap=0x2e0000) returned 1 [0059.162] GetProcessHeap () returned 0x2e0000 [0059.162] GetProcessHeap () returned 0x2e0000 [0059.162] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4f08) returned 1 [0059.162] GetProcessHeap () returned 0x2e0000 [0059.162] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f4f08) returned 0x14 [0059.162] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4f08 | out: hHeap=0x2e0000) returned 1 [0059.162] GetProcessHeap () returned 0x2e0000 [0059.163] GetProcessHeap () returned 0x2e0000 [0059.163] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4dd8) returned 1 [0059.163] GetProcessHeap () returned 0x2e0000 [0059.163] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f4dd8) returned 0x2 [0059.163] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4dd8 | out: hHeap=0x2e0000) returned 1 [0059.163] GetProcessHeap () returned 0x2e0000 [0059.163] GetProcessHeap () returned 0x2e0000 [0059.163] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4de8) returned 1 [0059.163] GetProcessHeap () returned 0x2e0000 [0059.163] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f4de8) returned 0x14 [0059.163] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4de8 | out: hHeap=0x2e0000) returned 1 [0059.163] GetProcessHeap () returned 0x2e0000 [0059.163] GetProcessHeap () returned 0x2e0000 [0059.163] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4e08) returned 1 [0059.163] GetProcessHeap () returned 0x2e0000 [0059.163] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f4e08) returned 0x14 [0059.163] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4e08 | out: hHeap=0x2e0000) returned 1 [0059.163] GetProcessHeap () returned 0x2e0000 [0059.163] GetProcessHeap () returned 0x2e0000 [0059.163] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4e28) returned 1 [0059.163] GetProcessHeap () returned 0x2e0000 [0059.163] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f4e28) returned 0x14 [0059.163] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4e28 | out: hHeap=0x2e0000) returned 1 [0059.163] GetProcessHeap () returned 0x2e0000 [0059.163] GetProcessHeap () returned 0x2e0000 [0059.163] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4e48) returned 1 [0059.163] GetProcessHeap () returned 0x2e0000 [0059.163] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f4e48) returned 0x14 [0059.163] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4e48 | out: hHeap=0x2e0000) returned 1 [0059.163] GetProcessHeap () returned 0x2e0000 [0059.163] GetProcessHeap () returned 0x2e0000 [0059.163] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f50e0) returned 1 [0059.163] GetProcessHeap () returned 0x2e0000 [0059.163] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f50e0) returned 0x14 [0059.163] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f50e0 | out: hHeap=0x2e0000) returned 1 [0059.163] GetProcessHeap () returned 0x2e0000 [0059.163] GetProcessHeap () returned 0x2e0000 [0059.163] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5100) returned 1 [0059.163] GetProcessHeap () returned 0x2e0000 [0059.164] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5100) returned 0x14 [0059.164] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5100 | out: hHeap=0x2e0000) returned 1 [0059.164] GetProcessHeap () returned 0x2e0000 [0059.164] GetProcessHeap () returned 0x2e0000 [0059.164] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f6748) returned 1 [0059.164] GetProcessHeap () returned 0x2e0000 [0059.164] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f6748) returned 0x30 [0059.164] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f6748 | out: hHeap=0x2e0000) returned 1 [0059.164] GetProcessHeap () returned 0x2e0000 [0059.164] GetProcessHeap () returned 0x2e0000 [0059.164] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5120) returned 1 [0059.164] GetProcessHeap () returned 0x2e0000 [0059.164] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5120) returned 0x14 [0059.164] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5120 | out: hHeap=0x2e0000) returned 1 [0059.164] GetProcessHeap () returned 0x2e0000 [0059.164] GetProcessHeap () returned 0x2e0000 [0059.164] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f6780) returned 1 [0059.164] GetProcessHeap () returned 0x2e0000 [0059.164] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f6780) returned 0x30 [0059.164] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f6780 | out: hHeap=0x2e0000) returned 1 [0059.164] GetProcessHeap () returned 0x2e0000 [0059.164] GetProcessHeap () returned 0x2e0000 [0059.164] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5160) returned 1 [0059.164] GetProcessHeap () returned 0x2e0000 [0059.164] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5160) returned 0x14 [0059.164] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5160 | out: hHeap=0x2e0000) returned 1 [0059.164] GetProcessHeap () returned 0x2e0000 [0059.164] GetProcessHeap () returned 0x2e0000 [0059.164] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x304438) returned 1 [0059.164] GetProcessHeap () returned 0x2e0000 [0059.164] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x304438) returned 0x86 [0059.164] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x304438 | out: hHeap=0x2e0000) returned 1 [0059.164] GetProcessHeap () returned 0x2e0000 [0059.164] GetProcessHeap () returned 0x2e0000 [0059.164] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5580) returned 1 [0059.164] GetProcessHeap () returned 0x2e0000 [0059.164] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5580) returned 0x14 [0059.164] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5580 | out: hHeap=0x2e0000) returned 1 [0059.165] GetProcessHeap () returned 0x2e0000 [0059.165] GetProcessHeap () returned 0x2e0000 [0059.165] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4a20) returned 1 [0059.165] GetProcessHeap () returned 0x2e0000 [0059.165] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f4a20) returned 0x10 [0059.165] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4a20 | out: hHeap=0x2e0000) returned 1 [0059.165] GetProcessHeap () returned 0x2e0000 [0059.165] GetProcessHeap () returned 0x2e0000 [0059.165] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4e68) returned 1 [0059.165] GetProcessHeap () returned 0x2e0000 [0059.165] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f4e68) returned 0x14 [0059.165] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4e68 | out: hHeap=0x2e0000) returned 1 [0059.165] GetProcessHeap () returned 0x2e0000 [0059.165] GetProcessHeap () returned 0x2e0000 [0059.165] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4e88) returned 1 [0059.165] GetProcessHeap () returned 0x2e0000 [0059.165] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f4e88) returned 0x14 [0059.165] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4e88 | out: hHeap=0x2e0000) returned 1 [0059.165] GetProcessHeap () returned 0x2e0000 [0059.165] GetProcessHeap () returned 0x2e0000 [0059.165] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4ea8) returned 1 [0059.165] GetProcessHeap () returned 0x2e0000 [0059.165] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f4ea8) returned 0x14 [0059.165] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4ea8 | out: hHeap=0x2e0000) returned 1 [0059.165] GetProcessHeap () returned 0x2e0000 [0059.165] GetProcessHeap () returned 0x2e0000 [0059.165] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4ec8) returned 1 [0059.165] GetProcessHeap () returned 0x2e0000 [0059.165] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f4ec8) returned 0x14 [0059.165] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4ec8 | out: hHeap=0x2e0000) returned 1 [0059.165] GetProcessHeap () returned 0x2e0000 [0059.165] GetProcessHeap () returned 0x2e0000 [0059.165] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4a38) returned 1 [0059.165] GetProcessHeap () returned 0x2e0000 [0059.165] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f4a38) returned 0x10 [0059.165] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4a38 | out: hHeap=0x2e0000) returned 1 [0059.165] GetProcessHeap () returned 0x2e0000 [0059.165] GetProcessHeap () returned 0x2e0000 [0059.165] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4ee8) returned 1 [0059.165] GetProcessHeap () returned 0x2e0000 [0059.166] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f4ee8) returned 0x14 [0059.166] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4ee8 | out: hHeap=0x2e0000) returned 1 [0059.166] GetProcessHeap () returned 0x2e0000 [0059.166] GetProcessHeap () returned 0x2e0000 [0059.166] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4f60) returned 1 [0059.166] GetProcessHeap () returned 0x2e0000 [0059.166] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f4f60) returned 0x14 [0059.166] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4f60 | out: hHeap=0x2e0000) returned 1 [0059.166] GetProcessHeap () returned 0x2e0000 [0059.166] GetProcessHeap () returned 0x2e0000 [0059.166] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4fa0) returned 1 [0059.166] GetProcessHeap () returned 0x2e0000 [0059.166] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f4fa0) returned 0x14 [0059.166] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4fa0 | out: hHeap=0x2e0000) returned 1 [0059.166] GetProcessHeap () returned 0x2e0000 [0059.166] GetProcessHeap () returned 0x2e0000 [0059.166] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4fe0) returned 1 [0059.166] GetProcessHeap () returned 0x2e0000 [0059.166] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f4fe0) returned 0x14 [0059.166] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4fe0 | out: hHeap=0x2e0000) returned 1 [0059.166] GetProcessHeap () returned 0x2e0000 [0059.166] GetProcessHeap () returned 0x2e0000 [0059.166] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5000) returned 1 [0059.166] GetProcessHeap () returned 0x2e0000 [0059.166] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5000) returned 0x14 [0059.166] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5000 | out: hHeap=0x2e0000) returned 1 [0059.166] GetProcessHeap () returned 0x2e0000 [0059.166] GetProcessHeap () returned 0x2e0000 [0059.166] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5060) returned 1 [0059.166] GetProcessHeap () returned 0x2e0000 [0059.166] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5060) returned 0x14 [0059.166] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5060 | out: hHeap=0x2e0000) returned 1 [0059.166] GetProcessHeap () returned 0x2e0000 [0059.166] GetProcessHeap () returned 0x2e0000 [0059.166] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5080) returned 1 [0059.166] GetProcessHeap () returned 0x2e0000 [0059.166] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f5080) returned 0x14 [0059.166] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f5080 | out: hHeap=0x2e0000) returned 1 [0059.167] GetProcessHeap () returned 0x2e0000 [0059.167] GetProcessHeap () returned 0x2e0000 [0059.167] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f50a0) returned 1 [0059.167] GetProcessHeap () returned 0x2e0000 [0059.167] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f50a0) returned 0x14 [0059.167] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f50a0 | out: hHeap=0x2e0000) returned 1 [0059.167] GetProcessHeap () returned 0x2e0000 [0059.167] GetProcessHeap () returned 0x2e0000 [0059.167] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4a50) returned 1 [0059.167] GetProcessHeap () returned 0x2e0000 [0059.167] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f4a50) returned 0x10 [0059.167] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4a50 | out: hHeap=0x2e0000) returned 1 [0059.167] GetProcessHeap () returned 0x2e0000 [0059.167] GetProcessHeap () returned 0x2e0000 [0059.167] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4f80) returned 1 [0059.167] GetProcessHeap () returned 0x2e0000 [0059.167] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f4f80) returned 0x14 [0059.167] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4f80 | out: hHeap=0x2e0000) returned 1 [0059.167] GetProcessHeap () returned 0x2e0000 [0059.167] GetProcessHeap () returned 0x2e0000 [0059.167] HeapValidate (hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4a08) returned 1 [0059.167] GetProcessHeap () returned 0x2e0000 [0059.167] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f4a08) returned 0x10 [0059.167] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4a08 | out: hHeap=0x2e0000) returned 1 [0059.167] exit (_Code=1) Thread: id = 110 os_tid = 0xbdc Process: id = "10" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x5d6f8000" os_pid = "0xbec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb48" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /C choice /C Y /N /D Y /T 3 & Del \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" /a" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 114 os_tid = 0xbf0 [0059.599] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x33f96c | out: lpSystemTimeAsFileTime=0x33f96c*(dwLowDateTime=0xe20d6a00, dwHighDateTime=0x1d531b1)) [0059.599] GetCurrentProcessId () returned 0xbec [0059.599] GetCurrentThreadId () returned 0xbf0 [0059.599] GetTickCount () returned 0x1da09 [0059.599] QueryPerformanceCounter (in: lpPerformanceCount=0x33f964 | out: lpPerformanceCount=0x33f964*=17986058813) returned 1 [0059.600] GetModuleHandleA (lpModuleName=0x0) returned 0x4a8c0000 [0059.600] __set_app_type (_Type=0x1) [0059.600] __p__fmode () returned 0x74eb31f4 [0059.600] __p__commode () returned 0x74eb31fc [0059.600] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a8e21a6) returned 0x0 [0059.600] __getmainargs (in: _Argc=0x4a8e4238, _Argv=0x4a8e4240, _Env=0x4a8e423c, _DoWildCard=0, _StartInfo=0x4a8e4140 | out: _Argc=0x4a8e4238, _Argv=0x4a8e4240, _Env=0x4a8e423c) returned 0 [0059.600] GetCurrentThreadId () returned 0xbf0 [0059.600] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xbf0) returned 0x60 [0059.601] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0059.601] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadUILanguage") returned 0x76c4a84f [0059.601] SetThreadUILanguage (LangId=0x0) returned 0x409 [0059.601] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0059.601] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x33f8fc | out: phkResult=0x33f8fc*=0x0) returned 0x2 [0059.601] VirtualQuery (in: lpAddress=0x33f933, lpBuffer=0x33f8cc, dwLength=0x1c | out: lpBuffer=0x33f8cc*(BaseAddress=0x33f000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.601] VirtualQuery (in: lpAddress=0x240000, lpBuffer=0x33f8cc, dwLength=0x1c | out: lpBuffer=0x33f8cc*(BaseAddress=0x240000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0059.601] VirtualQuery (in: lpAddress=0x241000, lpBuffer=0x33f8cc, dwLength=0x1c | out: lpBuffer=0x33f8cc*(BaseAddress=0x241000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0059.601] VirtualQuery (in: lpAddress=0x243000, lpBuffer=0x33f8cc, dwLength=0x1c | out: lpBuffer=0x33f8cc*(BaseAddress=0x243000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0059.601] VirtualQuery (in: lpAddress=0x340000, lpBuffer=0x33f8cc, dwLength=0x1c | out: lpBuffer=0x33f8cc*(BaseAddress=0x340000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x70000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0059.601] GetConsoleOutputCP () returned 0x1b5 [0059.601] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a8e4260 | out: lpCPInfo=0x4a8e4260) returned 1 [0059.602] SetConsoleCtrlHandler (HandlerRoutine=0x4a8de72a, Add=1) returned 1 [0059.602] _get_osfhandle (_FileHandle=1) returned 0x7 [0059.602] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0059.602] _get_osfhandle (_FileHandle=1) returned 0x7 [0059.602] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8e41ac | out: lpMode=0x4a8e41ac) returned 1 [0059.602] _get_osfhandle (_FileHandle=1) returned 0x7 [0059.602] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0059.602] _get_osfhandle (_FileHandle=0) returned 0x3 [0059.602] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8e41b0 | out: lpMode=0x4a8e41b0) returned 1 [0059.602] _get_osfhandle (_FileHandle=0) returned 0x3 [0059.602] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0059.603] GetEnvironmentStringsW () returned 0x3c2118* [0059.603] GetProcessHeap () returned 0x3b0000 [0059.603] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xaca) returned 0x3c2bf0 [0059.603] FreeEnvironmentStringsW (penv=0x3c2118) returned 1 [0059.603] GetProcessHeap () returned 0x3b0000 [0059.603] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x4) returned 0x3c18b0 [0059.603] GetEnvironmentStringsW () returned 0x3c2118* [0059.603] GetProcessHeap () returned 0x3b0000 [0059.603] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xaca) returned 0x3c36c8 [0059.603] FreeEnvironmentStringsW (penv=0x3c2118) returned 1 [0059.603] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x33e86c | out: phkResult=0x33e86c*=0x68) returned 0x0 [0059.603] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x33e874, lpData=0x33e878, lpcbData=0x33e870*=0x1000 | out: lpType=0x33e874*=0x0, lpData=0x33e878*=0x0, lpcbData=0x33e870*=0x1000) returned 0x2 [0059.603] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x33e874, lpData=0x33e878, lpcbData=0x33e870*=0x1000 | out: lpType=0x33e874*=0x4, lpData=0x33e878*=0x1, lpcbData=0x33e870*=0x4) returned 0x0 [0059.604] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x33e874, lpData=0x33e878, lpcbData=0x33e870*=0x1000 | out: lpType=0x33e874*=0x0, lpData=0x33e878*=0x1, lpcbData=0x33e870*=0x1000) returned 0x2 [0059.604] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x33e874, lpData=0x33e878, lpcbData=0x33e870*=0x1000 | out: lpType=0x33e874*=0x4, lpData=0x33e878*=0x0, lpcbData=0x33e870*=0x4) returned 0x0 [0059.604] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x33e874, lpData=0x33e878, lpcbData=0x33e870*=0x1000 | out: lpType=0x33e874*=0x4, lpData=0x33e878*=0x40, lpcbData=0x33e870*=0x4) returned 0x0 [0059.604] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x33e874, lpData=0x33e878, lpcbData=0x33e870*=0x1000 | out: lpType=0x33e874*=0x4, lpData=0x33e878*=0x40, lpcbData=0x33e870*=0x4) returned 0x0 [0059.604] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x33e874, lpData=0x33e878, lpcbData=0x33e870*=0x1000 | out: lpType=0x33e874*=0x0, lpData=0x33e878*=0x40, lpcbData=0x33e870*=0x1000) returned 0x2 [0059.604] RegCloseKey (hKey=0x68) returned 0x0 [0059.604] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x33e86c | out: phkResult=0x33e86c*=0x68) returned 0x0 [0059.604] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x33e874, lpData=0x33e878, lpcbData=0x33e870*=0x1000 | out: lpType=0x33e874*=0x0, lpData=0x33e878*=0x40, lpcbData=0x33e870*=0x1000) returned 0x2 [0059.604] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x33e874, lpData=0x33e878, lpcbData=0x33e870*=0x1000 | out: lpType=0x33e874*=0x4, lpData=0x33e878*=0x1, lpcbData=0x33e870*=0x4) returned 0x0 [0059.604] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x33e874, lpData=0x33e878, lpcbData=0x33e870*=0x1000 | out: lpType=0x33e874*=0x0, lpData=0x33e878*=0x1, lpcbData=0x33e870*=0x1000) returned 0x2 [0059.604] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x33e874, lpData=0x33e878, lpcbData=0x33e870*=0x1000 | out: lpType=0x33e874*=0x4, lpData=0x33e878*=0x0, lpcbData=0x33e870*=0x4) returned 0x0 [0059.604] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x33e874, lpData=0x33e878, lpcbData=0x33e870*=0x1000 | out: lpType=0x33e874*=0x4, lpData=0x33e878*=0x9, lpcbData=0x33e870*=0x4) returned 0x0 [0059.604] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x33e874, lpData=0x33e878, lpcbData=0x33e870*=0x1000 | out: lpType=0x33e874*=0x4, lpData=0x33e878*=0x9, lpcbData=0x33e870*=0x4) returned 0x0 [0059.604] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x33e874, lpData=0x33e878, lpcbData=0x33e870*=0x1000 | out: lpType=0x33e874*=0x0, lpData=0x33e878*=0x9, lpcbData=0x33e870*=0x1000) returned 0x2 [0059.604] RegCloseKey (hKey=0x68) returned 0x0 [0059.604] time (in: timer=0x0 | out: timer=0x0) returned 0x5d1cc61e [0059.604] srand (_Seed=0x5d1cc61e) [0059.604] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C choice /C Y /N /D Y /T 3 & Del \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" /a" [0059.604] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C choice /C Y /N /D Y /T 3 & Del \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" /a" [0059.604] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a8e5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0059.605] GetProcessHeap () returned 0x3b0000 [0059.605] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x210) returned 0x3c2118 [0059.605] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3c2120, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0059.605] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a8f0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0059.605] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a8f0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0059.605] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a8f0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0059.605] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0059.605] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0059.605] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0059.605] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0059.605] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0059.605] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0059.605] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0059.605] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0059.605] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0059.605] GetProcessHeap () returned 0x3b0000 [0059.605] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c2bf0 | out: hHeap=0x3b0000) returned 1 [0059.605] GetEnvironmentStringsW () returned 0x3c2330* [0059.605] GetProcessHeap () returned 0x3b0000 [0059.605] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xae2) returned 0x3c4c90 [0059.605] FreeEnvironmentStringsW (penv=0x3c2330) returned 1 [0059.605] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a8f0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0059.605] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a8f0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0059.606] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0059.606] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0059.606] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0059.606] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0059.606] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0059.606] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0059.606] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0059.606] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0059.606] GetProcessHeap () returned 0x3b0000 [0059.606] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x54) returned 0x3c17e0 [0059.606] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x33f638 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0059.606] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x33f638, lpFilePart=0x33f634 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x33f634*="Desktop") returned 0x25 [0059.606] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0059.606] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x33f3b4 | out: lpFindFileData=0x33f3b4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x3c5780 [0059.606] FindClose (in: hFindFile=0x3c5780 | out: hFindFile=0x3c5780) returned 1 [0059.606] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x33f3b4 | out: lpFindFileData=0x33f3b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x3c5780 [0059.606] FindClose (in: hFindFile=0x3c5780 | out: hFindFile=0x3c5780) returned 1 [0059.606] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0059.606] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x33f3b4 | out: lpFindFileData=0x33f3b4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcf1cdf70, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xcf1cdf70, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x3c5780 [0059.607] FindClose (in: hFindFile=0x3c5780 | out: hFindFile=0x3c5780) returned 1 [0059.607] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0059.607] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0059.607] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0059.607] GetProcessHeap () returned 0x3b0000 [0059.607] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c4c90 | out: hHeap=0x3b0000) returned 1 [0059.607] GetEnvironmentStringsW () returned 0x3c41a0* [0059.607] GetProcessHeap () returned 0x3b0000 [0059.607] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xb36) returned 0x3c5fc0 [0059.607] FreeEnvironmentStringsW (penv=0x3c41a0) returned 1 [0059.607] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a8e5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0059.607] GetProcessHeap () returned 0x3b0000 [0059.607] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c17e0 | out: hHeap=0x3b0000) returned 1 [0059.607] GetProcessHeap () returned 0x3b0000 [0059.607] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x400e) returned 0x3c6b00 [0059.608] GetProcessHeap () returned 0x3b0000 [0059.608] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xc6) returned 0x3c2e70 [0059.608] GetProcessHeap () returned 0x3b0000 [0059.608] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c6b00 | out: hHeap=0x3b0000) returned 1 [0059.608] GetConsoleOutputCP () returned 0x1b5 [0059.659] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a8e4260 | out: lpCPInfo=0x4a8e4260) returned 1 [0059.659] GetUserDefaultLCID () returned 0x409 [0059.659] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a8e4950, cchData=8 | out: lpLCData=":") returned 2 [0059.659] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x33f778, cchData=128 | out: lpLCData="0") returned 2 [0059.659] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x33f778, cchData=128 | out: lpLCData="0") returned 2 [0059.659] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x33f778, cchData=128 | out: lpLCData="1") returned 2 [0059.660] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a8e4940, cchData=8 | out: lpLCData="/") returned 2 [0059.660] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a8e4d80, cchData=32 | out: lpLCData="Mon") returned 4 [0059.660] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a8e4d40, cchData=32 | out: lpLCData="Tue") returned 4 [0059.660] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a8e4d00, cchData=32 | out: lpLCData="Wed") returned 4 [0059.660] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a8e4cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0059.660] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a8e4c80, cchData=32 | out: lpLCData="Fri") returned 4 [0059.660] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a8e4c40, cchData=32 | out: lpLCData="Sat") returned 4 [0059.660] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a8e4c00, cchData=32 | out: lpLCData="Sun") returned 4 [0059.660] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a8e4930, cchData=8 | out: lpLCData=".") returned 2 [0059.660] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a8e4920, cchData=8 | out: lpLCData=",") returned 2 [0059.660] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0059.661] GetProcessHeap () returned 0x3b0000 [0059.661] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20c) returned 0x3c2f40 [0059.661] GetConsoleTitleW (in: lpConsoleTitle=0x3c2f40, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0059.661] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0059.661] GetProcAddress (hModule=0x76c20000, lpProcName="CopyFileExW") returned 0x76c53b92 [0059.661] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0059.662] GetProcAddress (hModule=0x76c20000, lpProcName="SetConsoleInputExeNameW") returned 0x76c4a79d [0059.662] GetProcessHeap () returned 0x3b0000 [0059.662] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x400a) returned 0x3c6b00 [0059.662] GetProcessHeap () returned 0x3b0000 [0059.662] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c6b00 | out: hHeap=0x3b0000) returned 1 [0059.662] _wcsicmp (_String1="choice", _String2=")") returned 58 [0059.662] _wcsicmp (_String1="FOR", _String2="choice") returned 3 [0059.662] _wcsicmp (_String1="FOR/?", _String2="choice") returned 3 [0059.662] _wcsicmp (_String1="IF", _String2="choice") returned 6 [0059.662] _wcsicmp (_String1="IF/?", _String2="choice") returned 6 [0059.662] _wcsicmp (_String1="REM", _String2="choice") returned 15 [0059.663] _wcsicmp (_String1="REM/?", _String2="choice") returned 15 [0059.663] GetProcessHeap () returned 0x3b0000 [0059.663] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x58) returned 0x3c3158 [0059.663] GetProcessHeap () returned 0x3b0000 [0059.663] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x16) returned 0x3c1818 [0059.663] GetProcessHeap () returned 0x3b0000 [0059.663] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x30) returned 0x3c31b8 [0059.664] GetProcessHeap () returned 0x3b0000 [0059.664] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x58) returned 0x3c31f0 [0059.664] _wcsicmp (_String1="Del", _String2=")") returned 59 [0059.664] _wcsicmp (_String1="FOR", _String2="Del") returned 2 [0059.664] _wcsicmp (_String1="FOR/?", _String2="Del") returned 2 [0059.664] _wcsicmp (_String1="IF", _String2="Del") returned 5 [0059.664] _wcsicmp (_String1="IF/?", _String2="Del") returned 5 [0059.664] _wcsicmp (_String1="REM", _String2="Del") returned 14 [0059.664] _wcsicmp (_String1="REM/?", _String2="Del") returned 14 [0059.664] GetProcessHeap () returned 0x3b0000 [0059.664] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x58) returned 0x3c3250 [0059.664] GetProcessHeap () returned 0x3b0000 [0059.664] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x10) returned 0x3bffd8 [0059.666] GetProcessHeap () returned 0x3b0000 [0059.666] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x86) returned 0x3c32b0 [0059.666] GetConsoleTitleW (in: lpConsoleTitle=0x33f40c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0059.667] _wcsicmp (_String1="choice", _String2="DIR") returned -1 [0059.667] _wcsicmp (_String1="choice", _String2="ERASE") returned -2 [0059.667] _wcsicmp (_String1="choice", _String2="DEL") returned -1 [0059.667] _wcsicmp (_String1="choice", _String2="TYPE") returned -17 [0059.667] _wcsicmp (_String1="choice", _String2="COPY") returned -7 [0059.667] _wcsicmp (_String1="choice", _String2="CD") returned 4 [0059.667] _wcsicmp (_String1="choice", _String2="CHDIR") returned 11 [0059.667] _wcsicmp (_String1="choice", _String2="RENAME") returned -15 [0059.667] _wcsicmp (_String1="choice", _String2="REN") returned -15 [0059.667] _wcsicmp (_String1="choice", _String2="ECHO") returned -2 [0059.667] _wcsicmp (_String1="choice", _String2="SET") returned -16 [0059.667] _wcsicmp (_String1="choice", _String2="PAUSE") returned -13 [0059.667] _wcsicmp (_String1="choice", _String2="DATE") returned -1 [0059.667] _wcsicmp (_String1="choice", _String2="TIME") returned -17 [0059.667] _wcsicmp (_String1="choice", _String2="PROMPT") returned -13 [0059.667] _wcsicmp (_String1="choice", _String2="MD") returned -10 [0059.667] _wcsicmp (_String1="choice", _String2="MKDIR") returned -10 [0059.667] _wcsicmp (_String1="choice", _String2="RD") returned -15 [0059.667] _wcsicmp (_String1="choice", _String2="RMDIR") returned -15 [0059.667] _wcsicmp (_String1="choice", _String2="PATH") returned -13 [0059.667] _wcsicmp (_String1="choice", _String2="GOTO") returned -4 [0059.667] _wcsicmp (_String1="choice", _String2="SHIFT") returned -16 [0059.667] _wcsicmp (_String1="choice", _String2="CLS") returned -4 [0059.667] _wcsicmp (_String1="choice", _String2="CALL") returned 7 [0059.667] _wcsicmp (_String1="choice", _String2="VERIFY") returned -19 [0059.667] _wcsicmp (_String1="choice", _String2="VER") returned -19 [0059.667] _wcsicmp (_String1="choice", _String2="VOL") returned -19 [0059.667] _wcsicmp (_String1="choice", _String2="EXIT") returned -2 [0059.667] _wcsicmp (_String1="choice", _String2="SETLOCAL") returned -16 [0059.667] _wcsicmp (_String1="choice", _String2="ENDLOCAL") returned -2 [0059.667] _wcsicmp (_String1="choice", _String2="TITLE") returned -17 [0059.667] _wcsicmp (_String1="choice", _String2="START") returned -16 [0059.667] _wcsicmp (_String1="choice", _String2="DPATH") returned -1 [0059.667] _wcsicmp (_String1="choice", _String2="KEYS") returned -8 [0059.667] _wcsicmp (_String1="choice", _String2="MOVE") returned -10 [0059.668] _wcsicmp (_String1="choice", _String2="PUSHD") returned -13 [0059.668] _wcsicmp (_String1="choice", _String2="POPD") returned -13 [0059.668] _wcsicmp (_String1="choice", _String2="ASSOC") returned 2 [0059.668] _wcsicmp (_String1="choice", _String2="FTYPE") returned -3 [0059.668] _wcsicmp (_String1="choice", _String2="BREAK") returned 1 [0059.668] _wcsicmp (_String1="choice", _String2="COLOR") returned -7 [0059.668] _wcsicmp (_String1="choice", _String2="MKLINK") returned -10 [0059.668] _wcsicmp (_String1="choice", _String2="DIR") returned -1 [0059.668] _wcsicmp (_String1="choice", _String2="ERASE") returned -2 [0059.668] _wcsicmp (_String1="choice", _String2="DEL") returned -1 [0059.668] _wcsicmp (_String1="choice", _String2="TYPE") returned -17 [0059.668] _wcsicmp (_String1="choice", _String2="COPY") returned -7 [0059.668] _wcsicmp (_String1="choice", _String2="CD") returned 4 [0059.668] _wcsicmp (_String1="choice", _String2="CHDIR") returned 11 [0059.668] _wcsicmp (_String1="choice", _String2="RENAME") returned -15 [0059.668] _wcsicmp (_String1="choice", _String2="REN") returned -15 [0059.668] _wcsicmp (_String1="choice", _String2="ECHO") returned -2 [0059.668] _wcsicmp (_String1="choice", _String2="SET") returned -16 [0059.668] _wcsicmp (_String1="choice", _String2="PAUSE") returned -13 [0059.668] _wcsicmp (_String1="choice", _String2="DATE") returned -1 [0059.668] _wcsicmp (_String1="choice", _String2="TIME") returned -17 [0059.668] _wcsicmp (_String1="choice", _String2="PROMPT") returned -13 [0059.668] _wcsicmp (_String1="choice", _String2="MD") returned -10 [0059.668] _wcsicmp (_String1="choice", _String2="MKDIR") returned -10 [0059.668] _wcsicmp (_String1="choice", _String2="RD") returned -15 [0059.668] _wcsicmp (_String1="choice", _String2="RMDIR") returned -15 [0059.668] _wcsicmp (_String1="choice", _String2="PATH") returned -13 [0059.668] _wcsicmp (_String1="choice", _String2="GOTO") returned -4 [0059.668] _wcsicmp (_String1="choice", _String2="SHIFT") returned -16 [0059.668] _wcsicmp (_String1="choice", _String2="CLS") returned -4 [0059.668] _wcsicmp (_String1="choice", _String2="CALL") returned 7 [0059.668] _wcsicmp (_String1="choice", _String2="VERIFY") returned -19 [0059.668] _wcsicmp (_String1="choice", _String2="VER") returned -19 [0059.668] _wcsicmp (_String1="choice", _String2="VOL") returned -19 [0059.668] _wcsicmp (_String1="choice", _String2="EXIT") returned -2 [0059.668] _wcsicmp (_String1="choice", _String2="SETLOCAL") returned -16 [0059.668] _wcsicmp (_String1="choice", _String2="ENDLOCAL") returned -2 [0059.668] _wcsicmp (_String1="choice", _String2="TITLE") returned -17 [0059.668] _wcsicmp (_String1="choice", _String2="START") returned -16 [0059.669] _wcsicmp (_String1="choice", _String2="DPATH") returned -1 [0059.669] _wcsicmp (_String1="choice", _String2="KEYS") returned -8 [0059.669] _wcsicmp (_String1="choice", _String2="MOVE") returned -10 [0059.669] _wcsicmp (_String1="choice", _String2="PUSHD") returned -13 [0059.669] _wcsicmp (_String1="choice", _String2="POPD") returned -13 [0059.669] _wcsicmp (_String1="choice", _String2="ASSOC") returned 2 [0059.669] _wcsicmp (_String1="choice", _String2="FTYPE") returned -3 [0059.669] _wcsicmp (_String1="choice", _String2="BREAK") returned 1 [0059.669] _wcsicmp (_String1="choice", _String2="COLOR") returned -7 [0059.669] _wcsicmp (_String1="choice", _String2="MKLINK") returned -10 [0059.669] _wcsicmp (_String1="choice", _String2="FOR") returned -3 [0059.669] _wcsicmp (_String1="choice", _String2="IF") returned -6 [0059.669] _wcsicmp (_String1="choice", _String2="REM") returned -15 [0059.669] GetProcessHeap () returned 0x3b0000 [0059.669] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x210) returned 0x3c3340 [0059.669] GetProcessHeap () returned 0x3b0000 [0059.669] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3e) returned 0x3c3558 [0059.669] _wcsnicmp (_String1="choi", _String2="cmd ", _MaxCount=0x4) returned -5 [0059.669] GetProcessHeap () returned 0x3b0000 [0059.669] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x418) returned 0x3b07f0 [0059.669] SetErrorMode (uMode=0x0) returned 0x0 [0059.670] SetErrorMode (uMode=0x1) returned 0x0 [0059.670] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3b07f8, lpFilePart=0x33ef2c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x33ef2c*="Desktop") returned 0x25 [0059.670] SetErrorMode (uMode=0x0) returned 0x1 [0059.670] GetProcessHeap () returned 0x3b0000 [0059.670] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3b07f0, Size=0x62) returned 0x3b07f0 [0059.670] GetProcessHeap () returned 0x3b0000 [0059.670] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b07f0) returned 0x62 [0059.670] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a8f0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0059.670] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0059.670] GetProcessHeap () returned 0x3b0000 [0059.670] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x120) returned 0x3c35a0 [0059.670] GetProcessHeap () returned 0x3b0000 [0059.670] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x238) returned 0x3b0860 [0059.676] GetProcessHeap () returned 0x3b0000 [0059.676] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3b0860, Size=0x122) returned 0x3b0860 [0059.676] GetProcessHeap () returned 0x3b0000 [0059.676] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b0860) returned 0x122 [0059.676] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a8f0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0059.676] GetProcessHeap () returned 0x3b0000 [0059.676] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xe0) returned 0x3b0990 [0059.676] GetProcessHeap () returned 0x3b0000 [0059.676] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3b0990, Size=0x76) returned 0x3b0990 [0059.676] GetProcessHeap () returned 0x3b0000 [0059.676] RtlSizeHeap (HeapHandle=0x3b0000, Flags=0x0, MemoryPointer=0x3b0990) returned 0x76 [0059.676] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0059.676] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\choice.*", fInfoLevelId=0x1, lpFindFileData=0x33eca8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33eca8) returned 0xffffffff [0059.677] GetLastError () returned 0x2 [0059.677] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\choice", fInfoLevelId=0x1, lpFindFileData=0x33eca8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33eca8) returned 0xffffffff [0059.677] GetLastError () returned 0x2 [0059.677] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0059.677] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\choice.*", fInfoLevelId=0x1, lpFindFileData=0x33eca8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33eca8) returned 0x3b0a10 [0059.677] GetProcessHeap () returned 0x3b0000 [0059.677] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0x3b0a50 [0059.677] FindClose (in: hFindFile=0x3b0a10 | out: hFindFile=0x3b0a10) returned 1 [0059.677] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\choice.COM", fInfoLevelId=0x1, lpFindFileData=0x33eca8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33eca8) returned 0xffffffff [0059.677] GetLastError () returned 0x2 [0059.677] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\choice.EXE", fInfoLevelId=0x1, lpFindFileData=0x33eca8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33eca8) returned 0x3b0a10 [0059.677] GetProcessHeap () returned 0x3b0000 [0059.677] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3b0a50, Size=0x4) returned 0x3b0a50 [0059.677] FindClose (in: hFindFile=0x3b0a10 | out: hFindFile=0x3b0a10) returned 1 [0059.677] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0059.677] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0059.677] GetConsoleTitleW (in: lpConsoleTitle=0x33f1a0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0059.678] InitializeProcThreadAttributeList (in: lpAttributeList=0x33f028, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x33f0f0 | out: lpAttributeList=0x33f028, lpSize=0x33f0f0) returned 1 [0059.678] UpdateProcThreadAttribute (in: lpAttributeList=0x33f028, dwFlags=0x0, Attribute=0x60001, lpValue=0x33f0e8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x33f028, lpPreviousValue=0x0) returned 1 [0059.678] GetStartupInfoW (in: lpStartupInfo=0x33efe4 | out: lpStartupInfo=0x33efe4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0059.678] GetProcessHeap () returned 0x3b0000 [0059.678] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x18) returned 0x3b0a10 [0059.678] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0059.678] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0059.678] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0059.678] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0059.678] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0059.678] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0059.678] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0059.678] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0059.678] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0059.678] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0059.678] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0059.678] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0059.678] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0059.678] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0059.678] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0059.678] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0059.678] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0059.678] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0059.678] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0059.678] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0059.678] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0059.678] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0059.678] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0059.678] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0059.678] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0059.679] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0059.679] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0059.679] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0059.679] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0059.679] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0059.679] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0059.679] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0059.679] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0059.679] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0059.679] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0059.679] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0059.679] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0059.679] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0059.679] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0059.679] GetProcessHeap () returned 0x3b0000 [0059.679] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b0a10 | out: hHeap=0x3b0000) returned 1 [0059.679] GetProcessHeap () returned 0x3b0000 [0059.679] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xa) returned 0x3bfff0 [0059.679] lstrcmpW (lpString1="\\choice.exe", lpString2="\\XCOPY.EXE") returned -1 [0059.680] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\choice.exe", lpCommandLine="choice /C Y /N /D Y /T 3 ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x33f084*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="choice /C Y /N /D Y /T 3 ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x33f0d0 | out: lpCommandLine="choice /C Y /N /D Y /T 3 ", lpProcessInformation=0x33f0d0*(hProcess=0x78, hThread=0x74, dwProcessId=0x56c, dwThreadId=0x588)) returned 1 [0059.723] CloseHandle (hObject=0x74) returned 1 [0059.723] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0059.723] GetProcessHeap () returned 0x3b0000 [0059.723] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5fc0 | out: hHeap=0x3b0000) returned 1 [0059.723] GetEnvironmentStringsW () returned 0x3c5fc0* [0059.723] GetProcessHeap () returned 0x3b0000 [0059.723] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xb36) returned 0x3c41a0 [0059.723] FreeEnvironmentStringsW (penv=0x3c5fc0) returned 1 [0059.723] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0063.179] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x33efc4 | out: lpExitCode=0x33efc4*=0x1) returned 1 [0063.180] CloseHandle (hObject=0x78) returned 1 [0063.180] _vsnwprintf (in: _Buffer=0x33f10c, _BufferCount=0x13, _Format="%08X", _ArgList=0x33efd0 | out: _Buffer="00000001") returned 8 [0063.180] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000001") returned 1 [0063.180] GetProcessHeap () returned 0x3b0000 [0063.180] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c41a0 | out: hHeap=0x3b0000) returned 1 [0063.180] GetEnvironmentStringsW () returned 0x3c41a0* [0063.180] GetProcessHeap () returned 0x3b0000 [0063.180] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xb5c) returned 0x3c9668 [0063.180] FreeEnvironmentStringsW (penv=0x3c41a0) returned 1 [0063.180] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0063.180] GetProcessHeap () returned 0x3b0000 [0063.180] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9668 | out: hHeap=0x3b0000) returned 1 [0063.180] GetEnvironmentStringsW () returned 0x3c41a0* [0063.180] GetProcessHeap () returned 0x3b0000 [0063.180] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0xb5c) returned 0x3c9668 [0063.180] FreeEnvironmentStringsW (penv=0x3c41a0) returned 1 [0063.180] GetProcessHeap () returned 0x3b0000 [0063.180] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bfff0 | out: hHeap=0x3b0000) returned 1 [0063.180] DeleteProcThreadAttributeList (in: lpAttributeList=0x33f028 | out: lpAttributeList=0x33f028) [0063.181] GetConsoleTitleW (in: lpConsoleTitle=0x33f40c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0063.181] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x33f1c4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.181] GetProcessHeap () returned 0x3b0000 [0063.181] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x38) returned 0x3bf4d8 [0063.181] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x33e254 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.181] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x33e484, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x33e488, nFileSystemNameSize=0x106 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x33e484*=0xff, lpFileSystemFlags=0x0, lpFileSystemNameBuffer="NTFS") returned 1 [0063.181] _wcsicmp (_String1="NTFS", _String2="FAT") returned 8 [0063.181] GetProcessHeap () returned 0x3b0000 [0063.181] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x2c) returned 0x3b0af8 [0063.181] GetProcessHeap () returned 0x3b0000 [0063.181] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x258) returned 0x3b0e48 [0063.181] _wcsicmp (_String1="RegAsm.exe", _String2=".") returned 68 [0063.181] _wcsicmp (_String1="RegAsm.exe", _String2="..") returned 68 [0063.181] GetFileAttributesW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\regasm.exe")) returned 0x20 [0063.182] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x3b10b0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.182] FindFirstFileExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe", fInfoLevelId=0x0, lpFindFileData=0x3c5fcc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3c5fcc) returned 0x3c67d0 [0063.182] DeleteFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\regasm.exe")) returned 0 [0063.182] DeleteFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\regasm.exe")) returned 0 [0063.182] GetLastError () returned 0x5 [0063.182] _vsnwprintf (in: _Buffer=0x4a8f4640, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0x33e794 | out: _Buffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\r\n") returned 58 [0063.182] _get_osfhandle (_FileHandle=1) returned 0x7 [0063.182] GetFileType (hFile=0x7) returned 0x2 [0063.183] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0063.183] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x33e754 | out: lpMode=0x33e754) returned 1 [0063.183] _get_osfhandle (_FileHandle=1) returned 0x7 [0063.183] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a8f4640*, nNumberOfCharsToWrite=0x3a, lpNumberOfCharsWritten=0x33e780, lpReserved=0x0 | out: lpBuffer=0x4a8f4640*, lpNumberOfCharsWritten=0x33e780*=0x3a) returned 1 [0063.183] _get_osfhandle (_FileHandle=2) returned 0xb [0063.183] GetFileType (hFile=0xb) returned 0x2 [0063.183] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0063.183] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x33e708 | out: lpMode=0x33e708) returned 1 [0063.184] _get_osfhandle (_FileHandle=2) returned 0xb [0063.184] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x33e73c | out: lpConsoleScreenBufferInfo=0x33e73c) returned 1 [0063.184] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x4a8f4640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Access is denied.\r\n") returned 0x13 [0063.185] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a8f4640*, nNumberOfCharsToWrite=0x13, lpNumberOfCharsWritten=0x33e760, lpReserved=0x0 | out: lpBuffer=0x4a8f4640*, lpNumberOfCharsWritten=0x33e760*=0x13) returned 1 [0063.185] FindNextFileW (in: hFindFile=0x3c67d0, lpFindFileData=0x3c5fcc | out: lpFindFileData=0x3c5fcc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5f591240, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xfa98, dwReserved0=0x0, dwReserved1=0x0, cFileName="RegAsm.exe", cAlternateFileName="")) returned 0 [0063.186] GetLastError () returned 0x12 [0063.186] FindClose (in: hFindFile=0x3c67d0 | out: hFindFile=0x3c67d0) returned 1 [0063.186] GetProcessHeap () returned 0x3b0000 [0063.186] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5fc0 | out: hHeap=0x3b0000) returned 1 [0063.186] GetProcessHeap () returned 0x3b0000 [0063.186] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c2600 | out: hHeap=0x3b0000) returned 1 [0063.186] GetProcessHeap () returned 0x3b0000 [0063.186] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c5828 | out: hHeap=0x3b0000) returned 1 [0063.186] GetProcessHeap () returned 0x3b0000 [0063.186] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c2590 | out: hHeap=0x3b0000) returned 1 [0063.186] GetProcessHeap () returned 0x3b0000 [0063.186] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c2330 | out: hHeap=0x3b0000) returned 1 [0063.186] GetProcessHeap () returned 0x3b0000 [0063.186] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b10a8 | out: hHeap=0x3b0000) returned 1 [0063.186] GetProcessHeap () returned 0x3b0000 [0063.186] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b0e48 | out: hHeap=0x3b0000) returned 1 [0063.186] GetProcessHeap () returned 0x3b0000 [0063.186] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b0af8 | out: hHeap=0x3b0000) returned 1 [0063.186] GetProcessHeap () returned 0x3b0000 [0063.186] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf4d8 | out: hHeap=0x3b0000) returned 1 [0063.186] GetProcessHeap () returned 0x3b0000 [0063.186] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b0dc0 | out: hHeap=0x3b0000) returned 1 [0063.186] GetProcessHeap () returned 0x3b0000 [0063.186] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3b0d30 | out: hHeap=0x3b0000) returned 1 [0063.186] _get_osfhandle (_FileHandle=1) returned 0x7 [0063.186] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0063.187] _get_osfhandle (_FileHandle=1) returned 0x7 [0063.187] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8e41ac | out: lpMode=0x4a8e41ac) returned 1 [0063.187] _get_osfhandle (_FileHandle=0) returned 0x3 [0063.187] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8e41b0 | out: lpMode=0x4a8e41b0) returned 1 [0063.187] _get_osfhandle (_FileHandle=0) returned 0x3 [0063.187] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0063.187] SetConsoleInputExeNameW () returned 0x1 [0063.187] GetConsoleOutputCP () returned 0x1b5 [0063.187] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a8e4260 | out: lpCPInfo=0x4a8e4260) returned 1 [0063.187] SetThreadUILanguage (LangId=0x0) returned 0x409 [0063.188] exit (_Code=0) Process: id = "11" image_name = "choice.exe" filename = "c:\\windows\\syswow64\\choice.exe" page_root = "0x5e81d000" os_pid = "0x56c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbec" cmd_line = "choice /C Y /N /D Y /T 3 " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 115 os_tid = 0x588 Process: id = "12" image_name = "vbc.exe" filename = "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\vbc.exe" page_root = "0x5e58f000" os_pid = "0x8c4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xb14" cmd_line = "\"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 116 os_tid = 0x40c [0060.367] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff6c | out: lpSystemTimeAsFileTime=0x18ff6c*(dwLowDateTime=0xe2657ce0, dwHighDateTime=0x1d531b1)) [0060.367] GetCurrentThreadId () returned 0x40c [0060.367] GetCurrentProcessId () returned 0x8c4 [0060.367] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff64 | out: lpPerformanceCount=0x18ff64*=18062900572) returned 1 [0060.368] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0060.368] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0060.368] GetLastError () returned 0x57 [0060.368] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0060.368] GetLastError () returned 0x57 [0060.368] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0060.368] GetProcAddress (hModule=0x76c20000, lpProcName=0x431714) returned 0x76c34d28 [0060.368] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0060.368] GetLastError () returned 0x57 [0060.368] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0060.368] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0060.369] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0060.369] GetLastError () returned 0x57 [0060.369] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0060.369] GetLastError () returned 0x57 [0060.369] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0060.369] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0060.369] GetProcessHeap () returned 0x610000 [0060.369] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0060.369] GetLastError () returned 0x57 [0060.369] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0060.369] GetLastError () returned 0x57 [0060.369] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0060.369] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0060.370] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x364) returned 0x621818 [0060.370] SetLastError (dwErrCode=0x57) [0060.370] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xc00) returned 0x621b88 [0060.371] GetStartupInfoW (in: lpStartupInfo=0x18fea0 | out: lpStartupInfo=0x18fea0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4125e0, hStdOutput=0xd74d51d5, hStdError=0xfffffffe)) [0060.371] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0060.371] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0060.371] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0060.371] GetCommandLineA () returned="\"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe\"" [0060.371] GetCommandLineW () returned="\"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe\"" [0060.371] GetACP () returned 0x4e4 [0060.371] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x220) returned 0x622f90 [0060.371] IsValidCodePage (CodePage=0x4e4) returned 1 [0060.372] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fec0 | out: lpCPInfo=0x18fec0) returned 1 [0060.372] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f788 | out: lpCPInfo=0x18f788) returned 1 [0060.372] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd9c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0060.372] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd9c, cbMultiByte=256, lpWideCharStr=0x18f528, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0060.372] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f79c | out: lpCharType=0x18f79c) returned 1 [0060.372] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd9c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0060.372] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd9c, cbMultiByte=256, lpWideCharStr=0x18f4d8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿேBĀ") returned 256 [0060.372] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0060.372] GetLastError () returned 0x57 [0060.372] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0060.372] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿேBĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0060.372] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿேBĀ", cchSrc=256, lpDestStr=0x18f2c8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0060.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x18fc9c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x15\xbd\x11\xd7\xd8\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0060.372] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd9c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0060.372] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd9c, cbMultiByte=256, lpWideCharStr=0x18f4f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0060.372] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0060.372] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f2e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0060.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x18fb9c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x15\xbd\x11\xd7\xd8\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0060.372] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x80) returned 0x6215a8 [0060.372] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x4620d0, nSize=0x104 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\vbc.exe")) returned 0x35 [0060.372] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x3e) returned 0x621630 [0060.372] RtlInitializeSListHead (in: ListHead=0x461e98 | out: ListHead=0x461e98) [0060.372] GetLastError () returned 0x0 [0060.372] SetLastError (dwErrCode=0x0) [0060.372] GetEnvironmentStringsW () returned 0x6231b8* [0060.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0060.372] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x565) returned 0x623c90 [0060.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x623c90, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0060.373] FreeEnvironmentStringsW (penv=0x6231b8) returned 1 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x98) returned 0x6231b8 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x1f) returned 0x622f00 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x36) returned 0x623258 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x37) returned 0x623298 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x3c) returned 0x6232d8 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x31) returned 0x623320 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x17) returned 0x614980 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x24) returned 0x623360 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x14) returned 0x623390 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xd) returned 0x61f518 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x25) returned 0x6233b0 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x39) returned 0x6233e0 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x18) returned 0x623428 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x17) returned 0x623448 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xe) returned 0x61f530 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x69) returned 0x623468 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x3e) returned 0x6234e0 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x1b) returned 0x622f28 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x1d) returned 0x622f50 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x48) returned 0x623528 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x12) returned 0x623578 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x18) returned 0x623598 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x1b) returned 0x624218 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x24) returned 0x624a00 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x29) returned 0x624a30 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x1e) returned 0x624240 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x41) returned 0x624a68 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x17) returned 0x624ab8 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xf) returned 0x61f548 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x16) returned 0x624ad8 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x2a) returned 0x624af8 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x29) returned 0x624b30 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x15) returned 0x624b68 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x1e) returned 0x624268 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x2a) returned 0x624b88 [0060.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x12) returned 0x624bc0 [0060.374] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x18) returned 0x624be0 [0060.374] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x46) returned 0x624c00 [0060.374] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623c90 | out: hHeap=0x610000) returned 1 [0060.374] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0060.374] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0060.374] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0060.374] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0060.374] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0060.374] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0060.374] GetProcAddress (hModule=0x76c20000, lpProcName="InitOnceExecuteOnce") returned 0x76c4d627 [0060.374] GetProcAddress (hModule=0x76c20000, lpProcName="CreateEventExW") returned 0x76cb410b [0060.374] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreW") returned 0x76c4ca5a [0060.374] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreExW") returned 0x76cb4195 [0060.374] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolTimer") returned 0x76c4ee7e [0060.374] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolTimer") returned 0x7717441c [0060.374] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7719c50e [0060.374] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolTimer") returned 0x7719c381 [0060.374] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolWait") returned 0x76c4f088 [0060.374] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolWait") returned 0x771805d7 [0060.374] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolWait") returned 0x7719ca24 [0060.375] GetProcAddress (hModule=0x76c20000, lpProcName="FlushProcessWriteBuffers") returned 0x77150b8c [0060.375] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720fde8 [0060.375] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessorNumber") returned 0x771a1e1d [0060.375] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSymbolicLinkW") returned 0x76cacd11 [0060.375] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentPackageId") returned 0x0 [0060.375] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount64") returned 0x76c4eee0 [0060.375] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileInformationByHandleEx") returned 0x76c4c78f [0060.375] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileInformationByHandle") returned 0x76c5cbfc [0060.375] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimePreciseAsFileTime") returned 0x0 [0060.375] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeConditionVariable") returned 0x77168456 [0060.375] GetProcAddress (hModule=0x76c20000, lpProcName="WakeConditionVariable") returned 0x771d7de4 [0060.375] GetProcAddress (hModule=0x76c20000, lpProcName="WakeAllConditionVariable") returned 0x7719409d [0060.375] GetProcAddress (hModule=0x76c20000, lpProcName="SleepConditionVariableCS") returned 0x76cb4b32 [0060.375] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeSRWLock") returned 0x77168456 [0060.375] GetProcAddress (hModule=0x76c20000, lpProcName="AcquireSRWLockExclusive") returned 0x771629f1 [0060.375] GetProcAddress (hModule=0x76c20000, lpProcName="TryAcquireSRWLockExclusive") returned 0x77174892 [0060.375] GetProcAddress (hModule=0x76c20000, lpProcName="ReleaseSRWLockExclusive") returned 0x771629ab [0060.376] GetProcAddress (hModule=0x76c20000, lpProcName="SleepConditionVariableSRW") returned 0x76cb4b74 [0060.376] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolWork") returned 0x76c4ee45 [0060.376] GetProcAddress (hModule=0x76c20000, lpProcName="SubmitThreadpoolWork") returned 0x771a8491 [0060.376] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolWork") returned 0x7719d8e2 [0060.376] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringEx") returned 0x76cb46b1 [0060.376] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoEx") returned 0x76cb4751 [0060.376] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0060.376] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x800) returned 0x6235b8 [0060.376] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0060.376] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f4b4) returned 0x0 [0060.383] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x614820 [0060.384] GetProcAddress (hModule=0x76c20000, lpProcName="AreFileApisANSI") returned 0x76cb40d1 [0060.384] LoadLibraryExW (lpLibFileName="api-ms-win-core-string-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0060.384] GetLastError () returned 0x57 [0060.384] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringEx") returned 0x76cb46b1 [0060.384] GetProcAddress (hModule=0x76c20000, lpProcName="EnumSystemLocalesEx") returned 0x76cb424f [0060.384] LoadLibraryExW (lpLibFileName="api-ms-win-core-datetime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0060.384] GetLastError () returned 0x57 [0060.384] GetProcAddress (hModule=0x76c20000, lpProcName="GetDateFormatEx") returned 0x76cc6676 [0060.384] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoEx") returned 0x76cb4751 [0060.384] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeFormatEx") returned 0x76cc65f1 [0060.384] GetProcAddress (hModule=0x76c20000, lpProcName="GetUserDefaultLocaleName") returned 0x76cb47c1 [0060.384] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidLocaleName") returned 0x76cb47e1 [0060.384] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-obsolete-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0060.384] GetLastError () returned 0x57 [0060.384] GetProcAddress (hModule=0x76c20000, lpProcName="LCIDToLocaleName") returned 0x76c5ced4 [0060.384] GetProcAddress (hModule=0x76c20000, lpProcName="LocaleNameToLCID") returned 0x76cb4801 [0060.384] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624448 [0060.384] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x2) returned 0x623dc0 [0060.384] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623dc0 | out: hHeap=0x610000) returned 1 [0060.384] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x2) returned 0x623dc0 [0060.384] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623dd0 [0060.385] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x18) returned 0x623de0 [0060.385] GetLastError () returned 0x57 [0060.385] SetLastError (dwErrCode=0x57) [0060.385] GetLastError () returned 0x57 [0060.385] SetLastError (dwErrCode=0x57) [0060.385] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xb8) returned 0x623e00 [0060.385] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x6a6) returned 0x625098 [0060.385] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x625098 | out: hHeap=0x610000) returned 1 [0060.385] GetLastError () returned 0x57 [0060.385] SetLastError (dwErrCode=0x57) [0060.385] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x6) returned 0x623ec0 [0060.385] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x2) returned 0x623ed0 [0060.385] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x4) returned 0x623ee0 [0060.385] GetLastError () returned 0x57 [0060.385] SetLastError (dwErrCode=0x57) [0060.385] GetLastError () returned 0x57 [0060.385] SetLastError (dwErrCode=0x57) [0060.385] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xb8) returned 0x623ef0 [0060.385] GetLastError () returned 0x57 [0060.385] SetLastError (dwErrCode=0x57) [0060.385] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x6a6) returned 0x625098 [0060.385] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x625098 | out: hHeap=0x610000) returned 1 [0060.385] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0060.385] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e00 | out: hHeap=0x610000) returned 1 [0060.386] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ee0 | out: hHeap=0x610000) returned 1 [0060.386] GetLastError () returned 0x57 [0060.386] SetLastError (dwErrCode=0x57) [0060.386] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x6) returned 0x623ee0 [0060.386] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x2) returned 0x623e00 [0060.386] GetLastError () returned 0x57 [0060.386] SetLastError (dwErrCode=0x57) [0060.386] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x200) returned 0x623fb0 [0060.386] GetLastError () returned 0x57 [0060.386] SetLastError (dwErrCode=0x57) [0060.386] GetLastError () returned 0x57 [0060.386] SetLastError (dwErrCode=0x57) [0060.386] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x4) returned 0x6241b8 [0060.386] GetLastError () returned 0x57 [0060.386] SetLastError (dwErrCode=0x57) [0060.386] GetLastError () returned 0x57 [0060.386] SetLastError (dwErrCode=0x57) [0060.386] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xb8) returned 0x623e10 [0060.386] GetLastError () returned 0x57 [0060.386] SetLastError (dwErrCode=0x57) [0060.386] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x6a6) returned 0x625098 [0060.386] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x625098 | out: hHeap=0x610000) returned 1 [0060.386] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ee0 | out: hHeap=0x610000) returned 1 [0060.386] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ef0 | out: hHeap=0x610000) returned 1 [0060.386] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6241b8 | out: hHeap=0x610000) returned 1 [0060.386] GetLastError () returned 0x57 [0060.386] SetLastError (dwErrCode=0x57) [0060.386] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x6) returned 0x6241b8 [0060.386] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e00 | out: hHeap=0x610000) returned 1 [0060.386] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ed0 | out: hHeap=0x610000) returned 1 [0060.387] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623e00 [0060.387] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x623ed0 [0060.387] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624470 [0060.387] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624498 [0060.387] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x6244c0 [0060.387] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x31eb) returned 0x625098 [0060.387] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x6244e8 [0060.387] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624510 [0060.387] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624538 [0060.387] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6244c0 | out: hHeap=0x610000) returned 1 [0060.387] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624498 | out: hHeap=0x610000) returned 1 [0060.387] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624470 | out: hHeap=0x610000) returned 1 [0060.388] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624470 [0060.388] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624498 [0060.388] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x6244c0 [0060.388] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x48) returned 0x623f18 [0060.388] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624560 [0060.388] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624588 [0060.388] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x6245b0 [0060.388] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6244c0 | out: hHeap=0x610000) returned 1 [0060.388] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624498 | out: hHeap=0x610000) returned 1 [0060.388] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624470 | out: hHeap=0x610000) returned 1 [0060.388] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x970) returned 0x628290 [0060.388] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x970) returned 0x628c08 [0060.388] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x970) returned 0x629580 [0060.388] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x400) returned 0x629ef8 [0060.388] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624470 [0060.388] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6241c8 [0060.388] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624470 | out: hHeap=0x610000) returned 1 [0060.388] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x47) returned 0x62a300 [0060.388] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6241c8 | out: hHeap=0x610000) returned 1 [0060.388] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x6a) returned 0x62a350 [0060.388] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62a300 | out: hHeap=0x610000) returned 1 [0060.388] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x9e) returned 0x62a3c8 [0060.388] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62a350 | out: hHeap=0x610000) returned 1 [0060.388] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xec) returned 0x62a470 [0060.388] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62a3c8 | out: hHeap=0x610000) returned 1 [0060.389] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x161) returned 0x62a300 [0060.389] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62a470 | out: hHeap=0x610000) returned 1 [0060.389] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x211) returned 0x62a470 [0060.389] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62a300 | out: hHeap=0x610000) returned 1 [0060.389] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x319) returned 0x62a690 [0060.389] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62a470 | out: hHeap=0x610000) returned 1 [0060.389] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x4a5) returned 0x62a9b8 [0060.389] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62a690 | out: hHeap=0x610000) returned 1 [0060.389] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x6f7) returned 0x62ae68 [0060.389] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62a9b8 | out: hHeap=0x610000) returned 1 [0060.389] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa72) returned 0x62b568 [0060.389] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62ae68 | out: hHeap=0x610000) returned 1 [0060.389] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x629ef8 | out: hHeap=0x610000) returned 1 [0060.389] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x629580 | out: hHeap=0x610000) returned 1 [0060.389] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628c08 | out: hHeap=0x610000) returned 1 [0060.389] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628290 | out: hHeap=0x610000) returned 1 [0060.389] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628290 [0060.389] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624470 [0060.389] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6241c8 [0060.389] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624470 | out: hHeap=0x610000) returned 1 [0060.389] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x47) returned 0x6282e8 [0060.389] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6241c8 | out: hHeap=0x610000) returned 1 [0060.389] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x6a) returned 0x628338 [0060.389] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282e8 | out: hHeap=0x610000) returned 1 [0060.389] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x9e) returned 0x6283b0 [0060.389] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628338 | out: hHeap=0x610000) returned 1 [0060.389] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xec) returned 0x628458 [0060.389] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6283b0 | out: hHeap=0x610000) returned 1 [0060.389] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x161) returned 0x6282e8 [0060.389] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628458 | out: hHeap=0x610000) returned 1 [0060.389] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x211) returned 0x628458 [0060.389] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282e8 | out: hHeap=0x610000) returned 1 [0060.389] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x319) returned 0x628678 [0060.389] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628458 | out: hHeap=0x610000) returned 1 [0060.389] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x4a5) returned 0x6289a0 [0060.389] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628678 | out: hHeap=0x610000) returned 1 [0060.390] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x6f7) returned 0x628e50 [0060.390] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6289a0 | out: hHeap=0x610000) returned 1 [0060.390] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628290 | out: hHeap=0x610000) returned 1 [0060.390] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62b568 | out: hHeap=0x610000) returned 1 [0060.390] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x400) returned 0x628290 [0060.390] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628290 | out: hHeap=0x610000) returned 1 [0060.390] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6241c8 [0060.390] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x623f68 [0060.390] AreFileApisANSI () returned 1 [0060.390] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x623f68, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 60 [0060.390] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x78) returned 0x628290 [0060.390] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x623f68, cbMultiByte=-1, lpWideCharStr=0x628290, cchWideChar=60 | out: lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\000000000.key") returned 60 [0060.390] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\000000000.key" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\000000000.key"), dwDesiredAccess=0x80, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff [0060.390] GetLastError () returned 0x2 [0060.390] SetLastError (dwErrCode=0x2) [0060.390] GetLastError () returned 0x2 [0060.391] SetLastError (dwErrCode=0x2) [0060.391] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\000000000.key", nBufferLength=0x104, lpBuffer=0x18fa70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\000000000.key", lpFilePart=0x0) returned 0x3b [0060.391] GetLastError () returned 0x2 [0060.391] SetLastError (dwErrCode=0x2) [0060.391] GetLastError () returned 0x2 [0060.391] SetLastError (dwErrCode=0x2) [0060.391] GetLastError () returned 0x2 [0060.391] SetLastError (dwErrCode=0x2) [0060.391] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628290 | out: hHeap=0x610000) returned 1 [0060.391] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x628290 [0060.391] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.391] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x38) returned 0x6282b0 [0060.391] AreFileApisANSI () returned 1 [0060.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x623f68, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 60 [0060.391] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x78) returned 0x6282f0 [0060.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x623f68, cbMultiByte=-1, lpWideCharStr=0x6282f0, cchWideChar=60 | out: lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\000000000.key") returned 60 [0060.391] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\000000000.key" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\000000000.key"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18fb14, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x40 [0060.392] GetFileType (hFile=0x40) returned 0x1 [0060.392] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282f0 | out: hHeap=0x610000) returned 1 [0060.392] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282f0 [0060.392] GetLastError () returned 0x0 [0060.392] SetLastError (dwErrCode=0x0) [0060.392] GetLastError () returned 0x0 [0060.392] SetLastError (dwErrCode=0x0) [0060.393] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xb8) returned 0x628300 [0060.393] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x6a6) returned 0x6283c0 [0060.393] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6283c0 | out: hHeap=0x610000) returned 1 [0060.393] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6241b8 | out: hHeap=0x610000) returned 1 [0060.393] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e10 | out: hHeap=0x610000) returned 1 [0060.393] GetLastError () returned 0x0 [0060.393] SetLastError (dwErrCode=0x0) [0060.393] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x6) returned 0x6241b8 [0060.393] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x2) returned 0x623e10 [0060.393] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x4) returned 0x623e20 [0060.393] GetLastError () returned 0x0 [0060.393] SetLastError (dwErrCode=0x0) [0060.393] GetLastError () returned 0x0 [0060.393] SetLastError (dwErrCode=0x0) [0060.393] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xb8) returned 0x6283c0 [0060.393] GetLastError () returned 0x0 [0060.393] SetLastError (dwErrCode=0x0) [0060.393] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x6a6) returned 0x628480 [0060.393] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628480 | out: hHeap=0x610000) returned 1 [0060.393] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6241b8 | out: hHeap=0x610000) returned 1 [0060.393] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628300 | out: hHeap=0x610000) returned 1 [0060.393] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e20 | out: hHeap=0x610000) returned 1 [0060.393] GetLastError () returned 0x0 [0060.393] SetLastError (dwErrCode=0x0) [0060.393] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x6) returned 0x6241b8 [0060.393] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x2) returned 0x623e20 [0060.393] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x4) returned 0x623e30 [0060.393] GetLastError () returned 0x0 [0060.393] SetLastError (dwErrCode=0x0) [0060.393] GetLastError () returned 0x0 [0060.393] SetLastError (dwErrCode=0x0) [0060.394] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xb8) returned 0x628300 [0060.394] GetLastError () returned 0x0 [0060.394] SetLastError (dwErrCode=0x0) [0060.394] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x6a6) returned 0x628480 [0060.394] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628480 | out: hHeap=0x610000) returned 1 [0060.394] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6241b8 | out: hHeap=0x610000) returned 1 [0060.394] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6283c0 | out: hHeap=0x610000) returned 1 [0060.394] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e30 | out: hHeap=0x610000) returned 1 [0060.394] GetLastError () returned 0x0 [0060.394] SetLastError (dwErrCode=0x0) [0060.394] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x6) returned 0x6241b8 [0060.394] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e20 | out: hHeap=0x610000) returned 1 [0060.394] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e10 | out: hHeap=0x610000) returned 1 [0060.394] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623e10 [0060.394] LoadLibraryExW (lpLibFileName="api-ms-win-security-systemfunctions-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0060.394] GetLastError () returned 0x57 [0060.394] LoadLibraryExW (lpLibFileName="advapi32", hFile=0x0, dwFlags=0x800) returned 0x0 [0060.394] GetLastError () returned 0x57 [0060.394] LoadLibraryExW (lpLibFileName="advapi32", hFile=0x0, dwFlags=0x0) returned 0x74d40000 [0060.394] GetProcAddress (hModule=0x74d40000, lpProcName="SystemFunction036") returned 0x74d41919 [0060.394] SystemFunction036 (in: RandomBuffer=0x18fc9c, RandomBufferLength=0x4 | out: RandomBuffer=0x18fc9c) returned 1 [0060.395] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x629550 [0060.395] GetLastError () returned 0x57 [0060.395] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0060.395] SetLastError (dwErrCode=0x57) [0060.395] WriteFile (in: hFile=0x40, lpBuffer=0x18e7f4*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x18e7ec, lpOverlapped=0x0 | out: lpBuffer=0x18e7f4*, lpNumberOfBytesWritten=0x18e7ec*=0xf, lpOverlapped=0x0) returned 1 [0060.396] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x629550 | out: hHeap=0x610000) returned 1 [0060.396] CloseHandle (hObject=0x40) returned 1 [0060.397] GetLastError () returned 0x57 [0060.397] SetLastError (dwErrCode=0x57) [0060.397] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x629550 [0060.397] GetLastError () returned 0x57 [0060.397] SetLastError (dwErrCode=0x57) [0060.397] GetLastError () returned 0x57 [0060.397] SetLastError (dwErrCode=0x57) [0060.397] GetLastError () returned 0x57 [0060.397] SetLastError (dwErrCode=0x57) [0060.397] GetLastError () returned 0x57 [0060.397] SetLastError (dwErrCode=0x57) [0060.397] GetLastError () returned 0x57 [0060.397] SetLastError (dwErrCode=0x57) [0060.397] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.397] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628290 | out: hHeap=0x610000) returned 1 [0060.397] GetStartupInfoW (in: lpStartupInfo=0x18ff08 | out: lpStartupInfo=0x18ff08*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0060.397] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f910, nSize=0x104 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\vbc.exe")) returned 0x35 [0060.397] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x18f90c, lpdwDisposition=0x0 | out: phkResult=0x18f90c*=0x48, lpdwDisposition=0x0) returned 0x0 [0060.398] RegSetValueExW (in: hKey=0x48, lpValueName="MSFEEditor", Reserved=0x0, dwType=0x1, lpData="\"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe\" e", cbData=0x74 | out: lpData="\"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe\" e") returned 0x0 [0060.399] RegCloseKey (hKey=0x48) returned 0x0 [0060.399] GetLogicalDriveStringsA (in: nBufferLength=0x100, lpBuffer=0x18fe1c | out: lpBuffer="C:\\") returned 0x4 [0060.399] GetDriveTypeA (lpRootPathName="C:\\") returned 0x3 [0060.399] GetLastError () returned 0x0 [0060.399] SetLastError (dwErrCode=0x0) [0060.399] GetLastError () returned 0x0 [0060.399] SetLastError (dwErrCode=0x0) [0060.399] GetLastError () returned 0x0 [0060.399] SetLastError (dwErrCode=0x0) [0060.399] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x4) returned 0x628290 [0060.399] lstrlenA (lpString="C:\\") returned 3 [0060.399] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0060.399] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x6246c8 [0060.399] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.399] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623e20 [0060.399] AreFileApisANSI () returned 1 [0060.400] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6246c8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0060.400] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x2a) returned 0x623e30 [0060.400] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6246c8, cbMultiByte=-1, lpWideCharStr=0x623e30, cchWideChar=21 | out: lpWideCharStr="C:\\\\@@_README_@@.txt") returned 21 [0060.400] CreateFileW (lpFileName="C:\\\\@@_README_@@.txt" (normalized: "c:\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f190, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x48 [0060.400] GetFileType (hFile=0x48) returned 0x1 [0060.400] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e30 | out: hHeap=0x610000) returned 1 [0060.401] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62a558 [0060.401] GetLastError () returned 0x0 [0060.401] SetLastError (dwErrCode=0x0) [0060.401] WriteFile (in: hFile=0x48, lpBuffer=0x18ddfc*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18ddf4, lpOverlapped=0x0 | out: lpBuffer=0x18ddfc*, lpNumberOfBytesWritten=0x18ddf4*=0x563, lpOverlapped=0x0) returned 1 [0060.402] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62a558 | out: hHeap=0x610000) returned 1 [0060.402] CloseHandle (hObject=0x48) returned 1 [0060.403] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e20 | out: hHeap=0x610000) returned 1 [0060.403] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.403] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6246c8 | out: hHeap=0x610000) returned 1 [0060.403] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x6246c8 [0060.403] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.403] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623e20 [0060.403] AreFileApisANSI () returned 1 [0060.403] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6246c8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0060.403] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x623e30 [0060.403] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6246c8, cbMultiByte=-1, lpWideCharStr=0x623e30, cchWideChar=24 | out: lpWideCharStr="C:\\\\@@_ATTENTION_@@.txt") returned 24 [0060.403] CreateFileW (lpFileName="C:\\\\@@_ATTENTION_@@.txt" (normalized: "c:\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f190, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x48 [0060.403] GetFileType (hFile=0x48) returned 0x1 [0060.403] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e30 | out: hHeap=0x610000) returned 1 [0060.403] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62a558 [0060.403] GetLastError () returned 0x0 [0060.403] SetLastError (dwErrCode=0x0) [0060.404] WriteFile (in: hFile=0x48, lpBuffer=0x18ddfc*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18ddf4, lpOverlapped=0x0 | out: lpBuffer=0x18ddfc*, lpNumberOfBytesWritten=0x18ddf4*=0x563, lpOverlapped=0x0) returned 1 [0060.404] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62a558 | out: hHeap=0x610000) returned 1 [0060.404] CloseHandle (hObject=0x48) returned 1 [0060.405] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e20 | out: hHeap=0x610000) returned 1 [0060.405] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.405] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6246c8 | out: hHeap=0x610000) returned 1 [0060.405] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x6246c8 [0060.405] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.405] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623e20 [0060.405] AreFileApisANSI () returned 1 [0060.405] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6246c8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0060.405] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x2a) returned 0x623e30 [0060.405] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6246c8, cbMultiByte=-1, lpWideCharStr=0x623e30, cchWideChar=21 | out: lpWideCharStr="C:\\\\@@_HELPER_@@.txt") returned 21 [0060.405] CreateFileW (lpFileName="C:\\\\@@_HELPER_@@.txt" (normalized: "c:\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18f190, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x48 [0060.405] GetFileType (hFile=0x48) returned 0x1 [0060.405] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e30 | out: hHeap=0x610000) returned 1 [0060.405] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62a558 [0060.405] GetLastError () returned 0x0 [0060.406] SetLastError (dwErrCode=0x0) [0060.406] WriteFile (in: hFile=0x48, lpBuffer=0x18ddfc*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18ddf4, lpOverlapped=0x0 | out: lpBuffer=0x18ddfc*, lpNumberOfBytesWritten=0x18ddf4*=0x563, lpOverlapped=0x0) returned 1 [0060.406] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62a558 | out: hHeap=0x610000) returned 1 [0060.407] CloseHandle (hObject=0x48) returned 1 [0060.407] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e20 | out: hHeap=0x610000) returned 1 [0060.407] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.407] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6246c8 | out: hHeap=0x610000) returned 1 [0060.407] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0060.407] FindFirstFileA (in: lpFileName="C:\\\\*", lpFindFileData=0x18f490 | out: lpFindFileData=0x18f490*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51000352, dwReserved1=0xdc, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x623e20 [0060.407] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x6246f0 [0060.407] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624718 [0060.407] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624718 | out: hHeap=0x610000) returned 1 [0060.407] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6246f0 | out: hHeap=0x610000) returned 1 [0060.407] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x6246f0 [0060.407] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0060.407] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624718 [0060.407] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x623e60 [0060.407] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624718 | out: hHeap=0x610000) returned 1 [0060.407] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.407] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623e98 [0060.408] AreFileApisANSI () returned 1 [0060.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x623e60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 34 [0060.408] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x44) returned 0x628cc8 [0060.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x623e60, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=34 | out: lpWideCharStr="C:\\\\$Recycle.Bin\\@@_README_@@.txt") returned 34 [0060.408] CreateFileW (lpFileName="C:\\\\$Recycle.Bin\\@@_README_@@.txt" (normalized: "c:\\$recycle.bin\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e82c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c [0060.445] GetFileType (hFile=0x4c) returned 0x1 [0060.445] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0060.445] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62a558 [0060.445] GetLastError () returned 0x0 [0060.445] SetLastError (dwErrCode=0x0) [0060.445] WriteFile (in: hFile=0x4c, lpBuffer=0x18d498*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18d490, lpOverlapped=0x0 | out: lpBuffer=0x18d498*, lpNumberOfBytesWritten=0x18d490*=0x563, lpOverlapped=0x0) returned 1 [0060.446] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62a558 | out: hHeap=0x610000) returned 1 [0060.446] CloseHandle (hObject=0x4c) returned 1 [0060.446] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e98 | out: hHeap=0x610000) returned 1 [0060.446] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.446] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e60 | out: hHeap=0x610000) returned 1 [0060.446] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624718 [0060.446] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x623e60 [0060.446] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624718 | out: hHeap=0x610000) returned 1 [0060.446] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.447] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623e98 [0060.447] AreFileApisANSI () returned 1 [0060.447] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x623e60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 37 [0060.447] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x4a) returned 0x628cc8 [0060.447] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x623e60, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=37 | out: lpWideCharStr="C:\\\\$Recycle.Bin\\@@_ATTENTION_@@.txt") returned 37 [0060.447] CreateFileW (lpFileName="C:\\\\$Recycle.Bin\\@@_ATTENTION_@@.txt" (normalized: "c:\\$recycle.bin\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e82c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c [0060.487] GetFileType (hFile=0x4c) returned 0x1 [0060.487] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0060.487] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62a558 [0060.487] GetLastError () returned 0x0 [0060.487] SetLastError (dwErrCode=0x0) [0060.487] WriteFile (in: hFile=0x4c, lpBuffer=0x18d498*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18d490, lpOverlapped=0x0 | out: lpBuffer=0x18d498*, lpNumberOfBytesWritten=0x18d490*=0x563, lpOverlapped=0x0) returned 1 [0060.488] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62a558 | out: hHeap=0x610000) returned 1 [0060.488] CloseHandle (hObject=0x4c) returned 1 [0060.488] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e98 | out: hHeap=0x610000) returned 1 [0060.488] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.488] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e60 | out: hHeap=0x610000) returned 1 [0060.488] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624718 [0060.488] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x623e60 [0060.488] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624718 | out: hHeap=0x610000) returned 1 [0060.488] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.488] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623e98 [0060.489] AreFileApisANSI () returned 1 [0060.489] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x623e60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 34 [0060.489] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x44) returned 0x628cc8 [0060.489] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x623e60, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=34 | out: lpWideCharStr="C:\\\\$Recycle.Bin\\@@_HELPER_@@.txt") returned 34 [0060.489] CreateFileW (lpFileName="C:\\\\$Recycle.Bin\\@@_HELPER_@@.txt" (normalized: "c:\\$recycle.bin\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e82c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c [0060.489] GetFileType (hFile=0x4c) returned 0x1 [0060.489] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0060.489] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62a558 [0060.489] GetLastError () returned 0x0 [0060.489] SetLastError (dwErrCode=0x0) [0060.489] WriteFile (in: hFile=0x4c, lpBuffer=0x18d498*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18d490, lpOverlapped=0x0 | out: lpBuffer=0x18d498*, lpNumberOfBytesWritten=0x18d490*=0x563, lpOverlapped=0x0) returned 1 [0060.490] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62a558 | out: hHeap=0x610000) returned 1 [0060.490] CloseHandle (hObject=0x4c) returned 1 [0060.491] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e98 | out: hHeap=0x610000) returned 1 [0060.491] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.491] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e60 | out: hHeap=0x610000) returned 1 [0060.491] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0060.491] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6246f0 | out: hHeap=0x610000) returned 1 [0060.491] FindFirstFileA (in: lpFileName="C:\\\\$Recycle.Bin\\*", lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe27887e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe27887e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51000352, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x623e90 [0060.491] FindNextFileA (in: hFindFile=0x623e90, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe27887e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe27887e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51000352, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0060.491] FindNextFileA (in: hFindFile=0x623e90, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe27163c0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe27163c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe27887e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x51000352, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0060.491] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628770 [0060.491] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287a8 [0060.491] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287a8 | out: hHeap=0x610000) returned 1 [0060.491] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624718 [0060.491] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624718 | out: hHeap=0x610000) returned 1 [0060.491] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0060.491] FindNextFileA (in: hFindFile=0x623e90, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe27887e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe27887e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe27887e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6287a0, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0060.491] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628770 [0060.491] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287a8 [0060.491] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287a8 | out: hHeap=0x610000) returned 1 [0060.491] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624718 [0060.491] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624718 | out: hHeap=0x610000) returned 1 [0060.491] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0060.491] FindNextFileA (in: hFindFile=0x623e90, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe27163c0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe27163c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe27163c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6287a0, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0060.491] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628770 [0060.491] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287a8 [0060.491] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287a8 | out: hHeap=0x610000) returned 1 [0060.491] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624718 [0060.491] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624718 | out: hHeap=0x610000) returned 1 [0060.491] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0060.491] FindNextFileA (in: hFindFile=0x623e90, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610000, dwReserved1=0x6287a0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0060.492] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628770 [0060.492] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x6287b8 [0060.492] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628800 [0060.492] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287b8 | out: hHeap=0x610000) returned 1 [0060.492] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628800 | out: hHeap=0x610000) returned 1 [0060.492] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0060.492] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628770 [0060.492] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x6287b8 [0060.492] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628d10 [0060.492] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x77) returned 0x628d68 [0060.492] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d10 | out: hHeap=0x610000) returned 1 [0060.492] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.492] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623e60 [0060.492] AreFileApisANSI () returned 1 [0060.492] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628d68, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0060.492] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa2) returned 0x62b560 [0060.492] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628d68, cbMultiByte=-1, lpWideCharStr=0x62b560, cchWideChar=81 | out: lpWideCharStr="C:\\\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\@@_README_@@.txt") returned 81 [0060.492] CreateFileW (lpFileName="C:\\\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\@@_README_@@.txt" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0060.493] GetFileType (hFile=0x50) returned 0x1 [0060.493] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62b560 | out: hHeap=0x610000) returned 1 [0060.493] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62b560 [0060.493] GetLastError () returned 0x0 [0060.493] SetLastError (dwErrCode=0x0) [0060.493] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0060.494] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62b560 | out: hHeap=0x610000) returned 1 [0060.494] CloseHandle (hObject=0x50) returned 1 [0060.494] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e60 | out: hHeap=0x610000) returned 1 [0060.494] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.494] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d68 | out: hHeap=0x610000) returned 1 [0060.494] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628d10 [0060.494] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x77) returned 0x628d68 [0060.494] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d10 | out: hHeap=0x610000) returned 1 [0060.494] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.494] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623e60 [0060.495] AreFileApisANSI () returned 1 [0060.495] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628d68, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0060.495] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa8) returned 0x62b560 [0060.495] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628d68, cbMultiByte=-1, lpWideCharStr=0x62b560, cchWideChar=84 | out: lpWideCharStr="C:\\\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\@@_ATTENTION_@@.txt") returned 84 [0060.495] CreateFileW (lpFileName="C:\\\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\@@_ATTENTION_@@.txt" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0060.495] GetFileType (hFile=0x50) returned 0x1 [0060.495] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62b560 | out: hHeap=0x610000) returned 1 [0060.495] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62b560 [0060.495] GetLastError () returned 0x0 [0060.495] SetLastError (dwErrCode=0x0) [0060.495] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0060.496] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62b560 | out: hHeap=0x610000) returned 1 [0060.496] CloseHandle (hObject=0x50) returned 1 [0060.497] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e60 | out: hHeap=0x610000) returned 1 [0060.497] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.497] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d68 | out: hHeap=0x610000) returned 1 [0060.497] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628d10 [0060.497] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x77) returned 0x628d68 [0060.497] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d10 | out: hHeap=0x610000) returned 1 [0060.497] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.497] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623e60 [0060.497] AreFileApisANSI () returned 1 [0060.497] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628d68, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0060.497] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa2) returned 0x62b560 [0060.497] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628d68, cbMultiByte=-1, lpWideCharStr=0x62b560, cchWideChar=81 | out: lpWideCharStr="C:\\\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\@@_HELPER_@@.txt") returned 81 [0060.497] CreateFileW (lpFileName="C:\\\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\@@_HELPER_@@.txt" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0060.497] GetFileType (hFile=0x50) returned 0x1 [0060.497] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62b560 | out: hHeap=0x610000) returned 1 [0060.498] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62b560 [0060.498] GetLastError () returned 0x0 [0060.498] SetLastError (dwErrCode=0x0) [0060.498] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0060.499] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62b560 | out: hHeap=0x610000) returned 1 [0060.499] CloseHandle (hObject=0x50) returned 1 [0060.499] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e60 | out: hHeap=0x610000) returned 1 [0060.499] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.499] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d68 | out: hHeap=0x610000) returned 1 [0060.499] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287b8 | out: hHeap=0x610000) returned 1 [0060.499] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0060.499] FindFirstFileA (in: lpFileName="C:\\\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe27887e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe27887e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x628800 [0060.499] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe27887e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe27887e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0060.499] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe27887e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe27887e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe27887e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0060.499] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628770 [0060.499] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628840 [0060.499] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628840 | out: hHeap=0x610000) returned 1 [0060.499] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.499] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.499] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0060.499] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe27887e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe27887e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe27887e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628838, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0060.499] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628770 [0060.499] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628840 [0060.499] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628840 | out: hHeap=0x610000) returned 1 [0060.499] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.499] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.499] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0060.499] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe27887e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe27887e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe27887e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628838, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0060.499] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628770 [0060.500] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628840 [0060.500] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628840 | out: hHeap=0x610000) returned 1 [0060.500] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.500] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.500] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0060.500] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x610000, dwReserved1=0x628838, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0060.500] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628770 [0060.500] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628840 [0060.500] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628840 | out: hHeap=0x610000) returned 1 [0060.500] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0060.500] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x610000, dwReserved1=0x628838, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0060.500] FindClose (in: hFindFile=0x628800 | out: hFindFile=0x628800) returned 1 [0060.500] FindNextFileA (in: hFindFile=0x623e90, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610000, dwReserved1=0x6287a0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0060.500] FindClose (in: hFindFile=0x623e90 | out: hFindFile=0x623e90) returned 1 [0060.500] FindNextFileA (in: hFindFile=0x623e20, lpFindFileData=0x18f490 | out: lpFindFileData=0x18f490*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe26a3fa0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe26a3fa0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe26a3fa0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x51000352, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0060.500] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.500] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.500] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.500] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.500] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.500] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.500] FindNextFileA (in: hFindFile=0x623e20, lpFindFileData=0x18f490 | out: lpFindFileData=0x18f490*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe26a3fa0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe26a3fa0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe26a3fa0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x51000352, dwReserved1=0xdc, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0060.500] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.500] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.500] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.500] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.500] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.500] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.500] FindNextFileA (in: hFindFile=0x623e20, lpFindFileData=0x18f490 | out: lpFindFileData=0x18f490*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe26a3fa0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe26a3fa0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe26a3fa0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x51000352, dwReserved1=0xdc, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0060.500] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.500] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.500] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.500] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.501] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.501] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.501] FindNextFileA (in: hFindFile=0x623e20, lpFindFileData=0x18f490 | out: lpFindFileData=0x18f490*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51000352, dwReserved1=0xdc, cFileName="Boot", cAlternateFileName="")) returned 1 [0060.501] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0060.501] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.501] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.501] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623e60 [0060.501] AreFileApisANSI () returned 1 [0060.501] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 26 [0060.548] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x34) returned 0x623e70 [0060.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x623e70, cchWideChar=26 | out: lpWideCharStr="C:\\\\Boot\\@@_README_@@.txt") returned 26 [0060.548] CreateFileW (lpFileName="C:\\\\Boot\\@@_README_@@.txt" (normalized: "c:\\boot\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e82c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c [0060.549] GetFileType (hFile=0x4c) returned 0x1 [0060.549] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e70 | out: hHeap=0x610000) returned 1 [0060.549] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62b560 [0060.549] GetLastError () returned 0x0 [0060.549] SetLastError (dwErrCode=0x0) [0060.549] WriteFile (in: hFile=0x4c, lpBuffer=0x18d498*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18d490, lpOverlapped=0x0 | out: lpBuffer=0x18d498*, lpNumberOfBytesWritten=0x18d490*=0x563, lpOverlapped=0x0) returned 1 [0060.550] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62b560 | out: hHeap=0x610000) returned 1 [0060.550] CloseHandle (hObject=0x4c) returned 1 [0060.550] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e60 | out: hHeap=0x610000) returned 1 [0060.550] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.550] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.550] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.550] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.550] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623e60 [0060.550] AreFileApisANSI () returned 1 [0060.550] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0060.550] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x3a) returned 0x623e70 [0060.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x623e70, cchWideChar=29 | out: lpWideCharStr="C:\\\\Boot\\@@_ATTENTION_@@.txt") returned 29 [0060.551] CreateFileW (lpFileName="C:\\\\Boot\\@@_ATTENTION_@@.txt" (normalized: "c:\\boot\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e82c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c [0060.551] GetFileType (hFile=0x4c) returned 0x1 [0060.551] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e70 | out: hHeap=0x610000) returned 1 [0060.551] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62b560 [0060.551] GetLastError () returned 0x0 [0060.551] SetLastError (dwErrCode=0x0) [0060.551] WriteFile (in: hFile=0x4c, lpBuffer=0x18d498*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18d490, lpOverlapped=0x0 | out: lpBuffer=0x18d498*, lpNumberOfBytesWritten=0x18d490*=0x563, lpOverlapped=0x0) returned 1 [0060.552] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62b560 | out: hHeap=0x610000) returned 1 [0060.552] CloseHandle (hObject=0x4c) returned 1 [0060.552] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e60 | out: hHeap=0x610000) returned 1 [0060.552] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.552] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.552] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.552] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.553] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623e60 [0060.553] AreFileApisANSI () returned 1 [0060.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 26 [0060.553] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x34) returned 0x623e70 [0060.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x623e70, cchWideChar=26 | out: lpWideCharStr="C:\\\\Boot\\@@_HELPER_@@.txt") returned 26 [0060.553] CreateFileW (lpFileName="C:\\\\Boot\\@@_HELPER_@@.txt" (normalized: "c:\\boot\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e82c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c [0060.553] GetFileType (hFile=0x4c) returned 0x1 [0060.553] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e70 | out: hHeap=0x610000) returned 1 [0060.553] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62b560 [0060.553] GetLastError () returned 0x0 [0060.553] SetLastError (dwErrCode=0x0) [0060.553] WriteFile (in: hFile=0x4c, lpBuffer=0x18d498*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18d490, lpOverlapped=0x0 | out: lpBuffer=0x18d498*, lpNumberOfBytesWritten=0x18d490*=0x563, lpOverlapped=0x0) returned 1 [0060.554] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62b560 | out: hHeap=0x610000) returned 1 [0060.554] CloseHandle (hObject=0x4c) returned 1 [0060.555] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e60 | out: hHeap=0x610000) returned 1 [0060.555] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.555] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.555] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0060.555] FindFirstFileA (in: lpFileName="C:\\\\Boot\\*", lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2820d60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2820d60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x623e80 [0060.555] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2820d60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2820d60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0060.555] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2820d60, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2820d60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2820d60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0060.555] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.555] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.555] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.555] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.555] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.555] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.555] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2820d60, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2820d60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2820d60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0060.555] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.555] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.555] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.555] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.555] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.555] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.555] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2820d60, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2820d60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2820d60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0060.555] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.555] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.555] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.555] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.555] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.555] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.555] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="BCD", cAlternateFileName="")) returned 1 [0060.555] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0060.555] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.555] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.555] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.556] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.556] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0060.556] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.556] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.556] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.556] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.556] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0060.556] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.556] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.556] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.556] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.556] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0060.556] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.556] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.556] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.556] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.556] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0060.556] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0060.556] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.556] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0060.556] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.556] AreFileApisANSI () returned 1 [0060.556] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0060.556] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0060.556] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\cs-CZ\\@@_README_@@.txt") returned 32 [0060.556] CreateFileW (lpFileName="C:\\\\Boot\\cs-CZ\\@@_README_@@.txt" (normalized: "c:\\boot\\cs-cz\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0060.595] GetFileType (hFile=0x50) returned 0x1 [0060.595] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0060.595] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0060.595] GetLastError () returned 0x0 [0060.595] SetLastError (dwErrCode=0x0) [0060.596] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0060.596] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0060.597] CloseHandle (hObject=0x50) returned 1 [0060.597] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.597] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0060.597] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.597] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628cc8 [0060.597] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0060.597] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.597] AreFileApisANSI () returned 1 [0060.597] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0060.597] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x46) returned 0x628d00 [0060.597] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x628d00, cchWideChar=35 | out: lpWideCharStr="C:\\\\Boot\\cs-CZ\\@@_ATTENTION_@@.txt") returned 35 [0060.597] CreateFileW (lpFileName="C:\\\\Boot\\cs-CZ\\@@_ATTENTION_@@.txt" (normalized: "c:\\boot\\cs-cz\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0060.616] GetFileType (hFile=0x50) returned 0x1 [0060.616] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d00 | out: hHeap=0x610000) returned 1 [0060.616] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0060.616] GetLastError () returned 0x0 [0060.617] SetLastError (dwErrCode=0x0) [0060.617] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0060.617] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0060.618] CloseHandle (hObject=0x50) returned 1 [0060.620] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.620] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0060.620] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0060.620] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.620] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0060.620] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.620] AreFileApisANSI () returned 1 [0060.620] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0060.620] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0060.620] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\cs-CZ\\@@_HELPER_@@.txt") returned 32 [0060.620] CreateFileW (lpFileName="C:\\\\Boot\\cs-CZ\\@@_HELPER_@@.txt" (normalized: "c:\\boot\\cs-cz\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0060.620] GetFileType (hFile=0x50) returned 0x1 [0060.620] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0060.621] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0060.621] GetLastError () returned 0x0 [0060.621] SetLastError (dwErrCode=0x0) [0060.621] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0060.622] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0060.622] CloseHandle (hObject=0x50) returned 1 [0060.622] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.622] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0060.622] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.622] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0060.622] FindFirstFileA (in: lpFileName="C:\\\\Boot\\cs-CZ\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe28b92e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe28b92e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287a0 [0060.622] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe28b92e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe28b92e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0060.622] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2893180, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2893180, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe28b92e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0060.622] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287e0 [0060.622] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628818 [0060.622] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628818 | out: hHeap=0x610000) returned 1 [0060.622] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.622] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.622] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287e0 | out: hHeap=0x610000) returned 1 [0060.622] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe28b92e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe28b92e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe28b92e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0060.622] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.622] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.622] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.622] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.623] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.623] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.623] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2893180, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2893180, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2893180, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0060.623] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.623] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.623] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.623] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.623] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.623] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.623] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.623] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.623] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.623] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.623] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.623] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0060.623] FindClose (in: hFindFile=0x6287a0 | out: hFindFile=0x6287a0) returned 1 [0060.623] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="da-DK", cAlternateFileName="")) returned 1 [0060.623] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0060.623] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.623] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0060.623] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.623] AreFileApisANSI () returned 1 [0060.623] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0060.623] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0060.623] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\da-DK\\@@_README_@@.txt") returned 32 [0060.623] CreateFileW (lpFileName="C:\\\\Boot\\da-DK\\@@_README_@@.txt" (normalized: "c:\\boot\\da-dk\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0060.624] GetFileType (hFile=0x50) returned 0x1 [0060.624] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0060.624] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0060.624] GetLastError () returned 0x0 [0060.624] SetLastError (dwErrCode=0x0) [0060.624] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0060.625] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0060.625] CloseHandle (hObject=0x50) returned 1 [0060.625] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.625] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0060.625] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.625] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628cc8 [0060.625] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0060.625] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.625] AreFileApisANSI () returned 1 [0060.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0060.625] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x46) returned 0x628d00 [0060.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x628d00, cchWideChar=35 | out: lpWideCharStr="C:\\\\Boot\\da-DK\\@@_ATTENTION_@@.txt") returned 35 [0060.625] CreateFileW (lpFileName="C:\\\\Boot\\da-DK\\@@_ATTENTION_@@.txt" (normalized: "c:\\boot\\da-dk\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0060.639] GetFileType (hFile=0x50) returned 0x1 [0060.639] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d00 | out: hHeap=0x610000) returned 1 [0060.639] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0060.639] GetLastError () returned 0x0 [0060.639] SetLastError (dwErrCode=0x0) [0060.639] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0060.640] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0060.640] CloseHandle (hObject=0x50) returned 1 [0060.640] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.640] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0060.640] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0060.640] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.640] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0060.640] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.640] AreFileApisANSI () returned 1 [0060.640] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0060.640] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0060.640] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\da-DK\\@@_HELPER_@@.txt") returned 32 [0060.641] CreateFileW (lpFileName="C:\\\\Boot\\da-DK\\@@_HELPER_@@.txt" (normalized: "c:\\boot\\da-dk\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0060.641] GetFileType (hFile=0x50) returned 0x1 [0060.641] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0060.641] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0060.641] GetLastError () returned 0x0 [0060.641] SetLastError (dwErrCode=0x0) [0060.641] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0060.642] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0060.642] CloseHandle (hObject=0x50) returned 1 [0060.642] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.642] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0060.642] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.642] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0060.642] FindFirstFileA (in: lpFileName="C:\\\\Boot\\da-DK\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe28df440, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe28df440, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287a0 [0060.643] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe28df440, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe28df440, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0060.643] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe28b92e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe28b92e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe28df440, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0060.643] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287e0 [0060.643] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628818 [0060.643] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628818 | out: hHeap=0x610000) returned 1 [0060.643] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.643] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.643] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287e0 | out: hHeap=0x610000) returned 1 [0060.643] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe28df440, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe28df440, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe29055a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0060.643] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.643] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.643] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.643] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.643] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.643] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.643] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe28b92e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe28b92e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe28b92e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0060.643] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.643] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.643] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.643] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.643] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.643] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.643] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.643] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.643] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.643] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.643] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.643] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0060.643] FindClose (in: hFindFile=0x6287a0 | out: hFindFile=0x6287a0) returned 1 [0060.643] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="de-DE", cAlternateFileName="")) returned 1 [0060.643] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0060.644] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.644] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0060.644] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.644] AreFileApisANSI () returned 1 [0060.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0060.644] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0060.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\de-DE\\@@_README_@@.txt") returned 32 [0060.644] CreateFileW (lpFileName="C:\\\\Boot\\de-DE\\@@_README_@@.txt" (normalized: "c:\\boot\\de-de\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0060.704] GetFileType (hFile=0x50) returned 0x1 [0060.705] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0060.705] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0060.705] GetLastError () returned 0x0 [0060.705] SetLastError (dwErrCode=0x0) [0060.705] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0060.706] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0060.706] CloseHandle (hObject=0x50) returned 1 [0060.706] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.706] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0060.706] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.706] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628cc8 [0060.706] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0060.706] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.706] AreFileApisANSI () returned 1 [0060.706] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0060.706] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x46) returned 0x628d00 [0060.706] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x628d00, cchWideChar=35 | out: lpWideCharStr="C:\\\\Boot\\de-DE\\@@_ATTENTION_@@.txt") returned 35 [0060.706] CreateFileW (lpFileName="C:\\\\Boot\\de-DE\\@@_ATTENTION_@@.txt" (normalized: "c:\\boot\\de-de\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0060.753] GetFileType (hFile=0x50) returned 0x1 [0060.753] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d00 | out: hHeap=0x610000) returned 1 [0060.753] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0060.753] GetLastError () returned 0x0 [0060.753] SetLastError (dwErrCode=0x0) [0060.753] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0060.754] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0060.754] CloseHandle (hObject=0x50) returned 1 [0060.754] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.754] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0060.754] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0060.754] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.754] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0060.754] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.754] AreFileApisANSI () returned 1 [0060.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0060.754] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0060.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\de-DE\\@@_HELPER_@@.txt") returned 32 [0060.754] CreateFileW (lpFileName="C:\\\\Boot\\de-DE\\@@_HELPER_@@.txt" (normalized: "c:\\boot\\de-de\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0060.755] GetFileType (hFile=0x50) returned 0x1 [0060.755] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0060.755] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0060.755] GetLastError () returned 0x0 [0060.755] SetLastError (dwErrCode=0x0) [0060.755] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0060.756] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0060.756] CloseHandle (hObject=0x50) returned 1 [0060.757] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.757] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0060.757] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.757] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0060.757] FindFirstFileA (in: lpFileName="C:\\\\Boot\\de-DE\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2a0ff40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2a0ff40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287a0 [0060.757] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2a0ff40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2a0ff40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0060.757] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe299db20, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe299db20, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2a0ff40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0060.757] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287e0 [0060.757] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628818 [0060.757] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628818 | out: hHeap=0x610000) returned 1 [0060.757] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.757] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.757] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287e0 | out: hHeap=0x610000) returned 1 [0060.757] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a0ff40, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2a0ff40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2a0ff40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0060.757] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.757] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.757] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.757] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.757] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.757] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.757] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe299db20, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe299db20, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe299db20, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0060.757] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.757] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.757] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.757] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.757] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.757] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.758] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.758] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.758] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.758] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.758] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.758] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0060.758] FindClose (in: hFindFile=0x6287a0 | out: hFindFile=0x6287a0) returned 1 [0060.758] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="el-GR", cAlternateFileName="")) returned 1 [0060.758] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0060.758] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.758] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0060.758] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.758] AreFileApisANSI () returned 1 [0060.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0060.758] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0060.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\el-GR\\@@_README_@@.txt") returned 32 [0060.758] CreateFileW (lpFileName="C:\\\\Boot\\el-GR\\@@_README_@@.txt" (normalized: "c:\\boot\\el-gr\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0060.758] GetFileType (hFile=0x50) returned 0x1 [0060.758] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0060.759] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0060.759] GetLastError () returned 0x0 [0060.759] SetLastError (dwErrCode=0x0) [0060.759] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0060.760] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0060.760] CloseHandle (hObject=0x50) returned 1 [0060.760] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.760] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0060.760] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.760] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628cc8 [0060.760] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0060.760] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.760] AreFileApisANSI () returned 1 [0060.760] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0060.760] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x46) returned 0x628d00 [0060.760] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x628d00, cchWideChar=35 | out: lpWideCharStr="C:\\\\Boot\\el-GR\\@@_ATTENTION_@@.txt") returned 35 [0060.760] CreateFileW (lpFileName="C:\\\\Boot\\el-GR\\@@_ATTENTION_@@.txt" (normalized: "c:\\boot\\el-gr\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0060.802] GetFileType (hFile=0x50) returned 0x1 [0060.802] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d00 | out: hHeap=0x610000) returned 1 [0060.802] GetLastError () returned 0x0 [0060.802] SetLastError (dwErrCode=0x0) [0060.803] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0060.803] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0060.804] CloseHandle (hObject=0x50) returned 1 [0060.804] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.804] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0060.804] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0060.804] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.804] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0060.804] AreFileApisANSI () returned 1 [0060.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0060.804] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0060.804] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\el-GR\\@@_HELPER_@@.txt") returned 32 [0060.804] CreateFileW (lpFileName="C:\\\\Boot\\el-GR\\@@_HELPER_@@.txt" (normalized: "c:\\boot\\el-gr\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0060.804] GetFileType (hFile=0x50) returned 0x1 [0060.804] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0060.804] GetLastError () returned 0x0 [0060.804] SetLastError (dwErrCode=0x0) [0060.804] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0060.807] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0060.807] CloseHandle (hObject=0x50) returned 1 [0060.807] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.807] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0060.807] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.807] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0060.808] FindFirstFileA (in: lpFileName="C:\\\\Boot\\el-GR\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2a82360, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2a82360, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287a0 [0060.808] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2a82360, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2a82360, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0060.808] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a0ff40, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2a0ff40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2a82360, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0060.808] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287e0 [0060.808] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628818 [0060.808] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628818 | out: hHeap=0x610000) returned 1 [0060.808] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.808] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.808] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287e0 | out: hHeap=0x610000) returned 1 [0060.808] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a82360, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2a82360, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2a82360, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0060.808] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.808] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.808] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.808] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.808] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.808] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.808] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a0ff40, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2a0ff40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2a0ff40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0060.808] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.808] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.808] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.808] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.808] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.808] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.808] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.808] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.808] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.808] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.809] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.809] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0060.809] FindClose (in: hFindFile=0x6287a0 | out: hFindFile=0x6287a0) returned 1 [0060.809] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="en-US", cAlternateFileName="")) returned 1 [0060.809] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0060.809] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.809] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0060.809] AreFileApisANSI () returned 1 [0060.809] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0060.809] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0060.809] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\en-US\\@@_README_@@.txt") returned 32 [0060.809] CreateFileW (lpFileName="C:\\\\Boot\\en-US\\@@_README_@@.txt" (normalized: "c:\\boot\\en-us\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0060.848] GetFileType (hFile=0x50) returned 0x1 [0060.848] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0060.848] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0060.848] GetLastError () returned 0x0 [0060.848] SetLastError (dwErrCode=0x0) [0060.848] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0060.849] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0060.849] CloseHandle (hObject=0x50) returned 1 [0060.849] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.849] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0060.849] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.849] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628cc8 [0060.849] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0060.849] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.849] AreFileApisANSI () returned 1 [0060.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0060.849] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x46) returned 0x628d00 [0060.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x628d00, cchWideChar=35 | out: lpWideCharStr="C:\\\\Boot\\en-US\\@@_ATTENTION_@@.txt") returned 35 [0060.849] CreateFileW (lpFileName="C:\\\\Boot\\en-US\\@@_ATTENTION_@@.txt" (normalized: "c:\\boot\\en-us\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0060.896] GetFileType (hFile=0x50) returned 0x1 [0060.896] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d00 | out: hHeap=0x610000) returned 1 [0060.896] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0060.896] GetLastError () returned 0x0 [0060.896] SetLastError (dwErrCode=0x0) [0060.896] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0060.897] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0060.897] CloseHandle (hObject=0x50) returned 1 [0060.897] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.897] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0060.897] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0060.897] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.897] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0060.898] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.898] AreFileApisANSI () returned 1 [0060.898] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0060.898] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0060.898] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\en-US\\@@_HELPER_@@.txt") returned 32 [0060.898] CreateFileW (lpFileName="C:\\\\Boot\\en-US\\@@_HELPER_@@.txt" (normalized: "c:\\boot\\en-us\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0060.898] GetFileType (hFile=0x50) returned 0x1 [0060.898] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0060.898] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0060.898] GetLastError () returned 0x0 [0060.898] SetLastError (dwErrCode=0x0) [0060.898] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0060.899] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0060.899] CloseHandle (hObject=0x50) returned 1 [0060.899] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.899] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0060.899] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.899] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0060.899] FindFirstFileA (in: lpFileName="C:\\\\Boot\\en-US\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2b66ba0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2b66ba0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287a0 [0060.900] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2b66ba0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2b66ba0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0060.900] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2af4780, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2af4780, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2b66ba0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0060.900] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287e0 [0060.900] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628818 [0060.900] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628818 | out: hHeap=0x610000) returned 1 [0060.900] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.900] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.900] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287e0 | out: hHeap=0x610000) returned 1 [0060.900] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b66ba0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2b66ba0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2b66ba0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0060.900] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.900] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.900] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.900] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.900] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.900] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.900] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2af4780, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2af4780, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2af4780, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0060.900] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.900] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.900] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.900] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.900] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.900] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.900] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0060.900] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.900] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.900] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.900] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.900] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0060.900] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.900] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0060.901] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0060.901] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.901] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0060.901] FindClose (in: hFindFile=0x6287a0 | out: hFindFile=0x6287a0) returned 1 [0060.901] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="es-ES", cAlternateFileName="")) returned 1 [0060.901] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0060.901] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0060.901] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0060.901] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.901] AreFileApisANSI () returned 1 [0060.901] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0060.901] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0060.901] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\es-ES\\@@_README_@@.txt") returned 32 [0060.901] CreateFileW (lpFileName="C:\\\\Boot\\es-ES\\@@_README_@@.txt" (normalized: "c:\\boot\\es-es\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0060.993] GetFileType (hFile=0x50) returned 0x1 [0060.993] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0060.993] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0060.993] GetLastError () returned 0x0 [0060.993] SetLastError (dwErrCode=0x0) [0060.993] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0060.994] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0060.994] CloseHandle (hObject=0x50) returned 1 [0060.995] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0060.995] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0060.995] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0060.995] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628cc8 [0060.995] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0060.995] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0060.995] AreFileApisANSI () returned 1 [0060.995] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0060.995] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x46) returned 0x628d00 [0060.995] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x628d00, cchWideChar=35 | out: lpWideCharStr="C:\\\\Boot\\es-ES\\@@_ATTENTION_@@.txt") returned 35 [0060.995] CreateFileW (lpFileName="C:\\\\Boot\\es-ES\\@@_ATTENTION_@@.txt" (normalized: "c:\\boot\\es-es\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.071] GetFileType (hFile=0x50) returned 0x1 [0061.071] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d00 | out: hHeap=0x610000) returned 1 [0061.071] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.071] GetLastError () returned 0x0 [0061.071] SetLastError (dwErrCode=0x0) [0061.071] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.072] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.072] CloseHandle (hObject=0x50) returned 1 [0061.072] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.072] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.072] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.072] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.072] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.073] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.073] AreFileApisANSI () returned 1 [0061.073] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.073] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.073] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\es-ES\\@@_HELPER_@@.txt") returned 32 [0061.073] CreateFileW (lpFileName="C:\\\\Boot\\es-ES\\@@_HELPER_@@.txt" (normalized: "c:\\boot\\es-es\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.073] GetFileType (hFile=0x50) returned 0x1 [0061.073] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.073] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.073] GetLastError () returned 0x0 [0061.073] SetLastError (dwErrCode=0x0) [0061.073] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.074] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.074] CloseHandle (hObject=0x50) returned 1 [0061.074] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.074] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.074] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.074] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0061.074] FindFirstFileA (in: lpFileName="C:\\\\Boot\\es-ES\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2d09ac0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2d09ac0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287a0 [0061.075] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2d09ac0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2d09ac0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0061.075] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2c4b3e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2c4b3e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2d09ac0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.075] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287e0 [0061.075] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628818 [0061.075] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628818 | out: hHeap=0x610000) returned 1 [0061.075] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.075] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.075] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287e0 | out: hHeap=0x610000) returned 1 [0061.075] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d09ac0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2d09ac0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2d09ac0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.075] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.075] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.075] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.075] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.075] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.075] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.075] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2c4b3e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2c4b3e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2c4b3e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.075] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.075] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.075] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.075] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.075] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.075] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.075] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0061.075] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.075] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.075] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.075] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.075] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0061.075] FindClose (in: hFindFile=0x6287a0 | out: hFindFile=0x6287a0) returned 1 [0061.075] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0061.076] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0061.076] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.076] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.076] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.076] AreFileApisANSI () returned 1 [0061.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.076] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\fi-FI\\@@_README_@@.txt") returned 32 [0061.076] CreateFileW (lpFileName="C:\\\\Boot\\fi-FI\\@@_README_@@.txt" (normalized: "c:\\boot\\fi-fi\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.076] GetFileType (hFile=0x50) returned 0x1 [0061.076] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.076] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.076] GetLastError () returned 0x0 [0061.076] SetLastError (dwErrCode=0x0) [0061.076] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.077] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.077] CloseHandle (hObject=0x50) returned 1 [0061.077] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.077] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.077] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.077] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628cc8 [0061.077] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.077] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.078] AreFileApisANSI () returned 1 [0061.078] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0061.078] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x46) returned 0x628d00 [0061.078] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x628d00, cchWideChar=35 | out: lpWideCharStr="C:\\\\Boot\\fi-FI\\@@_ATTENTION_@@.txt") returned 35 [0061.078] CreateFileW (lpFileName="C:\\\\Boot\\fi-FI\\@@_ATTENTION_@@.txt" (normalized: "c:\\boot\\fi-fi\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.112] GetFileType (hFile=0x50) returned 0x1 [0061.112] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d00 | out: hHeap=0x610000) returned 1 [0061.112] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.112] GetLastError () returned 0x0 [0061.112] SetLastError (dwErrCode=0x0) [0061.112] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.113] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.113] CloseHandle (hObject=0x50) returned 1 [0061.114] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.114] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.114] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.114] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.114] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.114] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.114] AreFileApisANSI () returned 1 [0061.114] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.114] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.114] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\fi-FI\\@@_HELPER_@@.txt") returned 32 [0061.114] CreateFileW (lpFileName="C:\\\\Boot\\fi-FI\\@@_HELPER_@@.txt" (normalized: "c:\\boot\\fi-fi\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.114] GetFileType (hFile=0x50) returned 0x1 [0061.114] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.114] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.114] GetLastError () returned 0x0 [0061.114] SetLastError (dwErrCode=0x0) [0061.114] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.115] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.115] CloseHandle (hObject=0x50) returned 1 [0061.115] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.116] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.116] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.116] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0061.116] FindFirstFileA (in: lpFileName="C:\\\\Boot\\fi-FI\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2d7bee0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2d7bee0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287a0 [0061.116] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2d7bee0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2d7bee0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0061.116] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d09ac0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2d09ac0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2d7bee0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.116] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287e0 [0061.116] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628818 [0061.116] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628818 | out: hHeap=0x610000) returned 1 [0061.116] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.116] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.116] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287e0 | out: hHeap=0x610000) returned 1 [0061.116] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d7bee0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2d7bee0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2d7bee0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.116] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.116] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.116] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.116] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.116] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.116] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.116] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d09ac0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2d09ac0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2d09ac0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.116] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.116] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.116] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.116] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.116] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.116] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.116] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0061.116] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.117] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.117] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.117] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.117] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0061.117] FindClose (in: hFindFile=0x6287a0 | out: hFindFile=0x6287a0) returned 1 [0061.117] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="Fonts", cAlternateFileName="")) returned 1 [0061.117] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0061.117] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.117] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.117] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.117] AreFileApisANSI () returned 1 [0061.117] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.117] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.117] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\Fonts\\@@_README_@@.txt") returned 32 [0061.117] CreateFileW (lpFileName="C:\\\\Boot\\Fonts\\@@_README_@@.txt" (normalized: "c:\\boot\\fonts\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.138] GetFileType (hFile=0x50) returned 0x1 [0061.138] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.138] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.138] GetLastError () returned 0x0 [0061.138] SetLastError (dwErrCode=0x0) [0061.138] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.139] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.139] CloseHandle (hObject=0x50) returned 1 [0061.139] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.139] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.139] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.139] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628cc8 [0061.139] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.139] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.140] AreFileApisANSI () returned 1 [0061.140] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0061.140] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x46) returned 0x628d00 [0061.140] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x628d00, cchWideChar=35 | out: lpWideCharStr="C:\\\\Boot\\Fonts\\@@_ATTENTION_@@.txt") returned 35 [0061.140] CreateFileW (lpFileName="C:\\\\Boot\\Fonts\\@@_ATTENTION_@@.txt" (normalized: "c:\\boot\\fonts\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.140] GetFileType (hFile=0x50) returned 0x1 [0061.140] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d00 | out: hHeap=0x610000) returned 1 [0061.140] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.140] GetLastError () returned 0x0 [0061.140] SetLastError (dwErrCode=0x0) [0061.140] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.141] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.141] CloseHandle (hObject=0x50) returned 1 [0061.141] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.141] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.141] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.141] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.141] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.141] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.141] AreFileApisANSI () returned 1 [0061.141] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.141] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.141] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\Fonts\\@@_HELPER_@@.txt") returned 32 [0061.142] CreateFileW (lpFileName="C:\\\\Boot\\Fonts\\@@_HELPER_@@.txt" (normalized: "c:\\boot\\fonts\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.142] GetFileType (hFile=0x50) returned 0x1 [0061.142] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.142] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.142] GetLastError () returned 0x0 [0061.142] SetLastError (dwErrCode=0x0) [0061.142] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.143] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.143] CloseHandle (hObject=0x50) returned 1 [0061.143] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.143] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.143] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.143] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0061.143] FindFirstFileA (in: lpFileName="C:\\\\Boot\\Fonts\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2da2040, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2da2040, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287a0 [0061.143] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2da2040, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2da2040, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0061.144] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2da2040, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2da2040, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2da2040, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.144] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287e0 [0061.144] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628818 [0061.144] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628818 | out: hHeap=0x610000) returned 1 [0061.144] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.144] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.144] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287e0 | out: hHeap=0x610000) returned 1 [0061.144] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2da2040, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2da2040, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2dc81a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.144] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.144] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.144] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.144] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.144] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.144] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.144] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2da2040, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2da2040, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2da2040, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.144] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.144] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.144] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.144] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.144] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.144] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.144] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0061.144] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.144] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.144] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.144] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.144] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0061.144] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.144] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.144] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.144] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.144] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0061.144] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.144] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.144] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.144] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.144] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0061.145] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.145] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.145] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.145] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.145] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0061.145] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.145] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.145] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.145] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.145] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0061.145] FindClose (in: hFindFile=0x6287a0 | out: hFindFile=0x6287a0) returned 1 [0061.145] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0061.145] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0061.145] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.145] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.145] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.145] AreFileApisANSI () returned 1 [0061.145] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.145] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.145] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\fr-FR\\@@_README_@@.txt") returned 32 [0061.145] CreateFileW (lpFileName="C:\\\\Boot\\fr-FR\\@@_README_@@.txt" (normalized: "c:\\boot\\fr-fr\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.148] GetFileType (hFile=0x50) returned 0x1 [0061.148] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.148] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.148] GetLastError () returned 0x0 [0061.148] SetLastError (dwErrCode=0x0) [0061.148] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.149] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.149] CloseHandle (hObject=0x50) returned 1 [0061.149] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.149] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.149] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.149] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628cc8 [0061.149] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.149] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.149] AreFileApisANSI () returned 1 [0061.149] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0061.149] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x46) returned 0x628d00 [0061.149] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x628d00, cchWideChar=35 | out: lpWideCharStr="C:\\\\Boot\\fr-FR\\@@_ATTENTION_@@.txt") returned 35 [0061.149] CreateFileW (lpFileName="C:\\\\Boot\\fr-FR\\@@_ATTENTION_@@.txt" (normalized: "c:\\boot\\fr-fr\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.151] GetFileType (hFile=0x50) returned 0x1 [0061.151] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d00 | out: hHeap=0x610000) returned 1 [0061.151] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.151] GetLastError () returned 0x0 [0061.151] SetLastError (dwErrCode=0x0) [0061.151] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.152] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.152] CloseHandle (hObject=0x50) returned 1 [0061.152] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.152] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.153] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.153] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.153] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.153] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.153] AreFileApisANSI () returned 1 [0061.153] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.153] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.153] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\fr-FR\\@@_HELPER_@@.txt") returned 32 [0061.153] CreateFileW (lpFileName="C:\\\\Boot\\fr-FR\\@@_HELPER_@@.txt" (normalized: "c:\\boot\\fr-fr\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.153] GetFileType (hFile=0x50) returned 0x1 [0061.153] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.153] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.153] GetLastError () returned 0x0 [0061.153] SetLastError (dwErrCode=0x0) [0061.153] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.154] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.154] CloseHandle (hObject=0x50) returned 1 [0061.154] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.154] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.154] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.154] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0061.154] FindFirstFileA (in: lpFileName="C:\\\\Boot\\fr-FR\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2dc81a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2dc81a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287a0 [0061.155] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2dc81a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2dc81a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0061.155] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2dc81a0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2dc81a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2dc81a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.155] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287e0 [0061.155] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628818 [0061.155] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628818 | out: hHeap=0x610000) returned 1 [0061.155] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.155] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.155] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287e0 | out: hHeap=0x610000) returned 1 [0061.155] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2dc81a0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2dc81a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2dc81a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.155] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.155] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.155] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.155] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.155] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.155] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.155] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2dc81a0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2dc81a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2dc81a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.155] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.155] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.155] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.155] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.155] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.155] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.155] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0061.155] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.155] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.155] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.155] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.155] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0061.155] FindClose (in: hFindFile=0x6287a0 | out: hFindFile=0x6287a0) returned 1 [0061.156] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0061.156] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0061.156] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.156] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.156] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.156] AreFileApisANSI () returned 1 [0061.156] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.156] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.156] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\hu-HU\\@@_README_@@.txt") returned 32 [0061.156] CreateFileW (lpFileName="C:\\\\Boot\\hu-HU\\@@_README_@@.txt" (normalized: "c:\\boot\\hu-hu\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.156] GetFileType (hFile=0x50) returned 0x1 [0061.156] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.156] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.156] GetLastError () returned 0x0 [0061.156] SetLastError (dwErrCode=0x0) [0061.156] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.157] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.157] CloseHandle (hObject=0x50) returned 1 [0061.157] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.157] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.157] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.158] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628cc8 [0061.158] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.158] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.158] AreFileApisANSI () returned 1 [0061.158] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0061.158] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x46) returned 0x628d00 [0061.158] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x628d00, cchWideChar=35 | out: lpWideCharStr="C:\\\\Boot\\hu-HU\\@@_ATTENTION_@@.txt") returned 35 [0061.158] CreateFileW (lpFileName="C:\\\\Boot\\hu-HU\\@@_ATTENTION_@@.txt" (normalized: "c:\\boot\\hu-hu\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.160] GetFileType (hFile=0x50) returned 0x1 [0061.160] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d00 | out: hHeap=0x610000) returned 1 [0061.160] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.160] GetLastError () returned 0x0 [0061.160] SetLastError (dwErrCode=0x0) [0061.160] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.161] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.161] CloseHandle (hObject=0x50) returned 1 [0061.161] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.161] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.161] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.161] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.161] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.161] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.161] AreFileApisANSI () returned 1 [0061.161] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.161] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.161] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\hu-HU\\@@_HELPER_@@.txt") returned 32 [0061.161] CreateFileW (lpFileName="C:\\\\Boot\\hu-HU\\@@_HELPER_@@.txt" (normalized: "c:\\boot\\hu-hu\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.162] GetFileType (hFile=0x50) returned 0x1 [0061.162] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.162] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.162] GetLastError () returned 0x0 [0061.162] SetLastError (dwErrCode=0x0) [0061.162] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.163] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.163] CloseHandle (hObject=0x50) returned 1 [0061.163] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.163] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.163] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.163] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0061.163] FindFirstFileA (in: lpFileName="C:\\\\Boot\\hu-HU\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2dee300, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2dee300, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287a0 [0061.163] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2dee300, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2dee300, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0061.163] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2dee300, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2dee300, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2dee300, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.163] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287e0 [0061.163] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628818 [0061.163] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628818 | out: hHeap=0x610000) returned 1 [0061.163] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.163] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.163] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287e0 | out: hHeap=0x610000) returned 1 [0061.163] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2dee300, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2dee300, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2dee300, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.163] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.163] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.163] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.163] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.163] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.163] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.164] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2dc81a0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2dc81a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2dee300, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.164] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.164] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.164] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.164] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.164] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.164] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.164] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0061.164] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.164] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.164] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.164] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.164] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0061.164] FindClose (in: hFindFile=0x6287a0 | out: hFindFile=0x6287a0) returned 1 [0061.164] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="it-IT", cAlternateFileName="")) returned 1 [0061.164] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0061.164] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.164] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.164] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.164] AreFileApisANSI () returned 1 [0061.164] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.164] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.164] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\it-IT\\@@_README_@@.txt") returned 32 [0061.164] CreateFileW (lpFileName="C:\\\\Boot\\it-IT\\@@_README_@@.txt" (normalized: "c:\\boot\\it-it\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.165] GetFileType (hFile=0x50) returned 0x1 [0061.165] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.165] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.166] GetLastError () returned 0x0 [0061.166] SetLastError (dwErrCode=0x0) [0061.166] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.166] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.166] CloseHandle (hObject=0x50) returned 1 [0061.167] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.167] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.167] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.167] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628cc8 [0061.167] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.167] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.167] AreFileApisANSI () returned 1 [0061.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0061.167] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x46) returned 0x628d00 [0061.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x628d00, cchWideChar=35 | out: lpWideCharStr="C:\\\\Boot\\it-IT\\@@_ATTENTION_@@.txt") returned 35 [0061.167] CreateFileW (lpFileName="C:\\\\Boot\\it-IT\\@@_ATTENTION_@@.txt" (normalized: "c:\\boot\\it-it\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.169] GetFileType (hFile=0x50) returned 0x1 [0061.169] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d00 | out: hHeap=0x610000) returned 1 [0061.169] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.169] GetLastError () returned 0x0 [0061.169] SetLastError (dwErrCode=0x0) [0061.169] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.170] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.170] CloseHandle (hObject=0x50) returned 1 [0061.170] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.170] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.170] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.170] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.170] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.170] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.170] AreFileApisANSI () returned 1 [0061.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.170] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\it-IT\\@@_HELPER_@@.txt") returned 32 [0061.170] CreateFileW (lpFileName="C:\\\\Boot\\it-IT\\@@_HELPER_@@.txt" (normalized: "c:\\boot\\it-it\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.173] GetFileType (hFile=0x50) returned 0x1 [0061.173] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.173] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.174] GetLastError () returned 0x0 [0061.174] SetLastError (dwErrCode=0x0) [0061.174] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.174] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.174] CloseHandle (hObject=0x50) returned 1 [0061.175] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.175] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.175] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.175] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0061.175] FindFirstFileA (in: lpFileName="C:\\\\Boot\\it-IT\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2e14460, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e14460, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287a0 [0061.175] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2e14460, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e14460, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0061.175] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2dee300, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2dee300, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2dee300, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.175] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287e0 [0061.175] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628818 [0061.175] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628818 | out: hHeap=0x610000) returned 1 [0061.175] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.175] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.175] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287e0 | out: hHeap=0x610000) returned 1 [0061.175] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e14460, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2e14460, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e14460, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.175] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.175] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.175] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.175] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.175] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.175] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.175] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2dee300, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2dee300, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2dee300, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.175] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.175] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.175] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.175] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.176] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.176] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.176] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0061.176] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.176] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.176] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.176] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.176] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0061.176] FindClose (in: hFindFile=0x6287a0 | out: hFindFile=0x6287a0) returned 1 [0061.176] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0061.176] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0061.176] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.176] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.176] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.176] AreFileApisANSI () returned 1 [0061.176] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.176] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.176] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\ja-JP\\@@_README_@@.txt") returned 32 [0061.176] CreateFileW (lpFileName="C:\\\\Boot\\ja-JP\\@@_README_@@.txt" (normalized: "c:\\boot\\ja-jp\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.176] GetFileType (hFile=0x50) returned 0x1 [0061.176] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.177] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.177] GetLastError () returned 0x0 [0061.177] SetLastError (dwErrCode=0x0) [0061.177] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.177] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.178] CloseHandle (hObject=0x50) returned 1 [0061.178] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.178] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.178] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.178] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628cc8 [0061.178] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.178] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.178] AreFileApisANSI () returned 1 [0061.178] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0061.178] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x46) returned 0x628d00 [0061.178] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x628d00, cchWideChar=35 | out: lpWideCharStr="C:\\\\Boot\\ja-JP\\@@_ATTENTION_@@.txt") returned 35 [0061.178] CreateFileW (lpFileName="C:\\\\Boot\\ja-JP\\@@_ATTENTION_@@.txt" (normalized: "c:\\boot\\ja-jp\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.180] GetFileType (hFile=0x50) returned 0x1 [0061.180] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d00 | out: hHeap=0x610000) returned 1 [0061.180] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.180] GetLastError () returned 0x0 [0061.180] SetLastError (dwErrCode=0x0) [0061.180] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.181] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.181] CloseHandle (hObject=0x50) returned 1 [0061.181] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.181] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.181] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.181] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.181] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.181] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.181] AreFileApisANSI () returned 1 [0061.181] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.181] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.181] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\ja-JP\\@@_HELPER_@@.txt") returned 32 [0061.181] CreateFileW (lpFileName="C:\\\\Boot\\ja-JP\\@@_HELPER_@@.txt" (normalized: "c:\\boot\\ja-jp\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.182] GetFileType (hFile=0x50) returned 0x1 [0061.182] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.182] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.182] GetLastError () returned 0x0 [0061.182] SetLastError (dwErrCode=0x0) [0061.182] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.183] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.183] CloseHandle (hObject=0x50) returned 1 [0061.183] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.183] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.183] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.183] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0061.183] FindFirstFileA (in: lpFileName="C:\\\\Boot\\ja-JP\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2e14460, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e14460, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287a0 [0061.183] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2e14460, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e14460, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0061.183] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e14460, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2e14460, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e14460, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.183] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287e0 [0061.183] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628818 [0061.183] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628818 | out: hHeap=0x610000) returned 1 [0061.183] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.183] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.183] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287e0 | out: hHeap=0x610000) returned 1 [0061.183] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e14460, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2e14460, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e14460, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.183] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.183] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.183] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.184] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.184] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.184] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.184] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e14460, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2e14460, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e14460, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.184] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.184] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.184] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.184] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.184] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.184] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.184] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0061.184] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.184] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.184] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.184] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.184] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0061.184] FindClose (in: hFindFile=0x6287a0 | out: hFindFile=0x6287a0) returned 1 [0061.184] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0061.184] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0061.184] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.184] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.184] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.184] AreFileApisANSI () returned 1 [0061.184] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.184] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.184] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\ko-KR\\@@_README_@@.txt") returned 32 [0061.184] CreateFileW (lpFileName="C:\\\\Boot\\ko-KR\\@@_README_@@.txt" (normalized: "c:\\boot\\ko-kr\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.185] GetFileType (hFile=0x50) returned 0x1 [0061.185] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.185] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.185] GetLastError () returned 0x0 [0061.185] SetLastError (dwErrCode=0x0) [0061.185] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.186] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.186] CloseHandle (hObject=0x50) returned 1 [0061.187] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.187] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.187] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.187] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628cc8 [0061.187] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.187] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.187] AreFileApisANSI () returned 1 [0061.187] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0061.187] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x46) returned 0x628d00 [0061.187] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x628d00, cchWideChar=35 | out: lpWideCharStr="C:\\\\Boot\\ko-KR\\@@_ATTENTION_@@.txt") returned 35 [0061.187] CreateFileW (lpFileName="C:\\\\Boot\\ko-KR\\@@_ATTENTION_@@.txt" (normalized: "c:\\boot\\ko-kr\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.189] GetFileType (hFile=0x50) returned 0x1 [0061.189] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d00 | out: hHeap=0x610000) returned 1 [0061.189] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.189] GetLastError () returned 0x0 [0061.189] SetLastError (dwErrCode=0x0) [0061.189] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.190] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.190] CloseHandle (hObject=0x50) returned 1 [0061.190] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.190] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.190] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.190] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.190] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.190] AreFileApisANSI () returned 1 [0061.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.190] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\ko-KR\\@@_HELPER_@@.txt") returned 32 [0061.190] CreateFileW (lpFileName="C:\\\\Boot\\ko-KR\\@@_HELPER_@@.txt" (normalized: "c:\\boot\\ko-kr\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.190] GetFileType (hFile=0x50) returned 0x1 [0061.190] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.190] GetLastError () returned 0x0 [0061.191] SetLastError (dwErrCode=0x0) [0061.191] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.191] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.191] CloseHandle (hObject=0x50) returned 1 [0061.192] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.192] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.192] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.192] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0061.192] FindFirstFileA (in: lpFileName="C:\\\\Boot\\ko-KR\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2e3a5c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e3a5c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287a0 [0061.192] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2e3a5c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e3a5c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0061.192] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e14460, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2e14460, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e3a5c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.192] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287e0 [0061.192] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628818 [0061.192] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628818 | out: hHeap=0x610000) returned 1 [0061.192] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.192] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.192] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287e0 | out: hHeap=0x610000) returned 1 [0061.192] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e3a5c0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2e3a5c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e3a5c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.192] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.192] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.192] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.192] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.192] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.192] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.192] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e14460, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2e14460, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e14460, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.192] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.192] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.192] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.192] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.193] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.193] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.193] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0061.193] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.193] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.193] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.193] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.193] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0061.193] FindClose (in: hFindFile=0x6287a0 | out: hFindFile=0x6287a0) returned 1 [0061.193] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0061.193] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.193] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.193] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.193] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.193] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0061.193] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0061.193] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.193] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.193] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.193] AreFileApisANSI () returned 1 [0061.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.193] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\nb-NO\\@@_README_@@.txt") returned 32 [0061.193] CreateFileW (lpFileName="C:\\\\Boot\\nb-NO\\@@_README_@@.txt" (normalized: "c:\\boot\\nb-no\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.194] GetFileType (hFile=0x50) returned 0x1 [0061.194] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.194] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.194] GetLastError () returned 0x0 [0061.194] SetLastError (dwErrCode=0x0) [0061.194] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.195] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.195] CloseHandle (hObject=0x50) returned 1 [0061.195] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.195] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.195] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.195] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628cc8 [0061.195] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.195] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.195] AreFileApisANSI () returned 1 [0061.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0061.195] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x46) returned 0x628d00 [0061.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x628d00, cchWideChar=35 | out: lpWideCharStr="C:\\\\Boot\\nb-NO\\@@_ATTENTION_@@.txt") returned 35 [0061.195] CreateFileW (lpFileName="C:\\\\Boot\\nb-NO\\@@_ATTENTION_@@.txt" (normalized: "c:\\boot\\nb-no\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.197] GetFileType (hFile=0x50) returned 0x1 [0061.198] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d00 | out: hHeap=0x610000) returned 1 [0061.198] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.198] GetLastError () returned 0x0 [0061.198] SetLastError (dwErrCode=0x0) [0061.198] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.199] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.199] CloseHandle (hObject=0x50) returned 1 [0061.199] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.199] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.199] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.199] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.199] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.199] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.199] AreFileApisANSI () returned 1 [0061.199] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.199] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.199] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\nb-NO\\@@_HELPER_@@.txt") returned 32 [0061.199] CreateFileW (lpFileName="C:\\\\Boot\\nb-NO\\@@_HELPER_@@.txt" (normalized: "c:\\boot\\nb-no\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.199] GetFileType (hFile=0x50) returned 0x1 [0061.199] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.199] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.200] GetLastError () returned 0x0 [0061.200] SetLastError (dwErrCode=0x0) [0061.200] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.200] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.200] CloseHandle (hObject=0x50) returned 1 [0061.201] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.201] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.201] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.201] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0061.201] FindFirstFileA (in: lpFileName="C:\\\\Boot\\nb-NO\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2e3a5c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e3a5c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287a0 [0061.201] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2e3a5c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e3a5c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0061.201] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e3a5c0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2e3a5c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e3a5c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.201] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287e0 [0061.201] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628818 [0061.201] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628818 | out: hHeap=0x610000) returned 1 [0061.201] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.201] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.201] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287e0 | out: hHeap=0x610000) returned 1 [0061.201] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e3a5c0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2e3a5c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e3a5c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.201] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.201] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.201] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.201] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.201] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.201] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.201] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e3a5c0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2e3a5c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e3a5c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.201] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.201] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.201] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.202] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.202] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.202] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.202] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0061.202] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.202] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.202] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.202] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.202] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0061.202] FindClose (in: hFindFile=0x6287a0 | out: hFindFile=0x6287a0) returned 1 [0061.202] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0061.202] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0061.202] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.202] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.202] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.202] AreFileApisANSI () returned 1 [0061.202] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.202] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.202] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\nl-NL\\@@_README_@@.txt") returned 32 [0061.202] CreateFileW (lpFileName="C:\\\\Boot\\nl-NL\\@@_README_@@.txt" (normalized: "c:\\boot\\nl-nl\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.207] GetFileType (hFile=0x50) returned 0x1 [0061.207] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.207] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.207] GetLastError () returned 0x0 [0061.207] SetLastError (dwErrCode=0x0) [0061.207] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.208] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.208] CloseHandle (hObject=0x50) returned 1 [0061.208] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.208] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.208] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.208] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628cc8 [0061.209] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.209] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.209] AreFileApisANSI () returned 1 [0061.209] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0061.209] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x46) returned 0x628d00 [0061.209] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x628d00, cchWideChar=35 | out: lpWideCharStr="C:\\\\Boot\\nl-NL\\@@_ATTENTION_@@.txt") returned 35 [0061.209] CreateFileW (lpFileName="C:\\\\Boot\\nl-NL\\@@_ATTENTION_@@.txt" (normalized: "c:\\boot\\nl-nl\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.211] GetFileType (hFile=0x50) returned 0x1 [0061.211] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d00 | out: hHeap=0x610000) returned 1 [0061.211] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.211] GetLastError () returned 0x0 [0061.211] SetLastError (dwErrCode=0x0) [0061.211] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.212] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.212] CloseHandle (hObject=0x50) returned 1 [0061.212] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.212] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.212] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.212] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.212] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.212] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.212] AreFileApisANSI () returned 1 [0061.212] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.212] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.212] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\nl-NL\\@@_HELPER_@@.txt") returned 32 [0061.212] CreateFileW (lpFileName="C:\\\\Boot\\nl-NL\\@@_HELPER_@@.txt" (normalized: "c:\\boot\\nl-nl\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.213] GetFileType (hFile=0x50) returned 0x1 [0061.213] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.213] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.213] GetLastError () returned 0x0 [0061.213] SetLastError (dwErrCode=0x0) [0061.213] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.214] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.214] CloseHandle (hObject=0x50) returned 1 [0061.214] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.214] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.214] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.214] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0061.214] FindFirstFileA (in: lpFileName="C:\\\\Boot\\nl-NL\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2e60720, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e60720, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287a0 [0061.215] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2e60720, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e60720, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0061.215] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e60720, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2e60720, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e60720, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.215] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287e0 [0061.215] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628818 [0061.215] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628818 | out: hHeap=0x610000) returned 1 [0061.215] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.215] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.215] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287e0 | out: hHeap=0x610000) returned 1 [0061.215] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e60720, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2e60720, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e60720, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.215] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.215] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.215] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.215] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.215] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.215] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.215] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e60720, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2e60720, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e60720, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.215] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.215] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.215] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.215] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.215] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.215] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.215] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0061.215] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.215] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.215] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.215] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.215] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0061.215] FindClose (in: hFindFile=0x6287a0 | out: hFindFile=0x6287a0) returned 1 [0061.215] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0061.216] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0061.216] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.216] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.216] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.216] AreFileApisANSI () returned 1 [0061.216] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.216] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.216] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\pl-PL\\@@_README_@@.txt") returned 32 [0061.216] CreateFileW (lpFileName="C:\\\\Boot\\pl-PL\\@@_README_@@.txt" (normalized: "c:\\boot\\pl-pl\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.216] GetFileType (hFile=0x50) returned 0x1 [0061.216] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.216] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.216] GetLastError () returned 0x0 [0061.216] SetLastError (dwErrCode=0x0) [0061.216] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.217] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.217] CloseHandle (hObject=0x50) returned 1 [0061.217] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.217] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.217] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.217] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628cc8 [0061.217] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.217] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.218] AreFileApisANSI () returned 1 [0061.218] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0061.218] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x46) returned 0x628d00 [0061.218] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x628d00, cchWideChar=35 | out: lpWideCharStr="C:\\\\Boot\\pl-PL\\@@_ATTENTION_@@.txt") returned 35 [0061.218] CreateFileW (lpFileName="C:\\\\Boot\\pl-PL\\@@_ATTENTION_@@.txt" (normalized: "c:\\boot\\pl-pl\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.220] GetFileType (hFile=0x50) returned 0x1 [0061.220] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d00 | out: hHeap=0x610000) returned 1 [0061.220] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.220] GetLastError () returned 0x0 [0061.220] SetLastError (dwErrCode=0x0) [0061.220] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.221] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.221] CloseHandle (hObject=0x50) returned 1 [0061.221] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.221] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.221] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.221] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.221] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.221] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.221] AreFileApisANSI () returned 1 [0061.221] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.221] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.221] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\pl-PL\\@@_HELPER_@@.txt") returned 32 [0061.221] CreateFileW (lpFileName="C:\\\\Boot\\pl-PL\\@@_HELPER_@@.txt" (normalized: "c:\\boot\\pl-pl\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.222] GetFileType (hFile=0x50) returned 0x1 [0061.222] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.222] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.222] GetLastError () returned 0x0 [0061.222] SetLastError (dwErrCode=0x0) [0061.222] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.223] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.223] CloseHandle (hObject=0x50) returned 1 [0061.223] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.223] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.223] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.223] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0061.223] FindFirstFileA (in: lpFileName="C:\\\\Boot\\pl-PL\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2e86880, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e86880, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287a0 [0061.223] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2e86880, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e86880, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0061.223] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e60720, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2e60720, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e86880, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.223] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287e0 [0061.223] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628818 [0061.223] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628818 | out: hHeap=0x610000) returned 1 [0061.223] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.224] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.224] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287e0 | out: hHeap=0x610000) returned 1 [0061.224] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e86880, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2e86880, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e86880, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.224] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.224] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.224] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.224] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.224] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.224] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.224] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e60720, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2e60720, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e60720, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.224] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.224] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.224] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.224] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.224] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.224] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.224] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0061.224] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.224] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.224] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.224] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.224] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0061.224] FindClose (in: hFindFile=0x6287a0 | out: hFindFile=0x6287a0) returned 1 [0061.224] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0061.224] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0061.224] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.224] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.224] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.224] AreFileApisANSI () returned 1 [0061.224] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.224] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.224] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\pt-BR\\@@_README_@@.txt") returned 32 [0061.224] CreateFileW (lpFileName="C:\\\\Boot\\pt-BR\\@@_README_@@.txt" (normalized: "c:\\boot\\pt-br\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.226] GetFileType (hFile=0x50) returned 0x1 [0061.226] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.226] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.226] GetLastError () returned 0x0 [0061.226] SetLastError (dwErrCode=0x0) [0061.226] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.227] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.227] CloseHandle (hObject=0x50) returned 1 [0061.227] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.227] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.227] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.227] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628cc8 [0061.227] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.227] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.227] AreFileApisANSI () returned 1 [0061.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0061.227] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x46) returned 0x628d00 [0061.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x628d00, cchWideChar=35 | out: lpWideCharStr="C:\\\\Boot\\pt-BR\\@@_ATTENTION_@@.txt") returned 35 [0061.227] CreateFileW (lpFileName="C:\\\\Boot\\pt-BR\\@@_ATTENTION_@@.txt" (normalized: "c:\\boot\\pt-br\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.229] GetFileType (hFile=0x50) returned 0x1 [0061.229] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d00 | out: hHeap=0x610000) returned 1 [0061.229] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.229] GetLastError () returned 0x0 [0061.229] SetLastError (dwErrCode=0x0) [0061.229] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.230] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.230] CloseHandle (hObject=0x50) returned 1 [0061.230] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.230] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.230] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.230] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.230] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.230] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.230] AreFileApisANSI () returned 1 [0061.230] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.230] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.231] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\pt-BR\\@@_HELPER_@@.txt") returned 32 [0061.231] CreateFileW (lpFileName="C:\\\\Boot\\pt-BR\\@@_HELPER_@@.txt" (normalized: "c:\\boot\\pt-br\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.231] GetFileType (hFile=0x50) returned 0x1 [0061.232] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.232] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.232] GetLastError () returned 0x0 [0061.232] SetLastError (dwErrCode=0x0) [0061.232] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.233] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.233] CloseHandle (hObject=0x50) returned 1 [0061.233] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.233] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.233] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.233] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0061.233] FindFirstFileA (in: lpFileName="C:\\\\Boot\\pt-BR\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2e86880, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e86880, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287a0 [0061.233] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2e86880, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e86880, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0061.233] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e86880, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2e86880, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e86880, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.233] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287e0 [0061.233] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628818 [0061.233] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628818 | out: hHeap=0x610000) returned 1 [0061.233] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.233] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.233] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287e0 | out: hHeap=0x610000) returned 1 [0061.233] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e86880, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2e86880, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e86880, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.233] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.233] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.233] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.233] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.233] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.233] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.233] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e86880, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2e86880, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2e86880, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.234] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.234] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.234] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.234] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.234] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.234] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.234] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0061.234] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.234] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.234] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.234] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.234] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0061.234] FindClose (in: hFindFile=0x6287a0 | out: hFindFile=0x6287a0) returned 1 [0061.234] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0061.234] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0061.234] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.234] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.234] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.234] AreFileApisANSI () returned 1 [0061.234] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.234] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.234] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\pt-PT\\@@_README_@@.txt") returned 32 [0061.234] CreateFileW (lpFileName="C:\\\\Boot\\pt-PT\\@@_README_@@.txt" (normalized: "c:\\boot\\pt-pt\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.235] GetFileType (hFile=0x50) returned 0x1 [0061.235] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.235] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.235] GetLastError () returned 0x0 [0061.235] SetLastError (dwErrCode=0x0) [0061.235] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.236] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.236] CloseHandle (hObject=0x50) returned 1 [0061.236] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.236] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.236] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.236] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628cc8 [0061.236] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.236] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.236] AreFileApisANSI () returned 1 [0061.236] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0061.236] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x46) returned 0x628d00 [0061.236] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x628d00, cchWideChar=35 | out: lpWideCharStr="C:\\\\Boot\\pt-PT\\@@_ATTENTION_@@.txt") returned 35 [0061.236] CreateFileW (lpFileName="C:\\\\Boot\\pt-PT\\@@_ATTENTION_@@.txt" (normalized: "c:\\boot\\pt-pt\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.239] GetFileType (hFile=0x50) returned 0x1 [0061.239] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d00 | out: hHeap=0x610000) returned 1 [0061.239] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.239] GetLastError () returned 0x0 [0061.239] SetLastError (dwErrCode=0x0) [0061.239] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.240] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.240] CloseHandle (hObject=0x50) returned 1 [0061.240] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.240] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.240] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.240] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.240] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.240] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.240] AreFileApisANSI () returned 1 [0061.240] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.240] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.240] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\pt-PT\\@@_HELPER_@@.txt") returned 32 [0061.240] CreateFileW (lpFileName="C:\\\\Boot\\pt-PT\\@@_HELPER_@@.txt" (normalized: "c:\\boot\\pt-pt\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.240] GetFileType (hFile=0x50) returned 0x1 [0061.241] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.241] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.241] GetLastError () returned 0x0 [0061.241] SetLastError (dwErrCode=0x0) [0061.241] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.242] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.242] CloseHandle (hObject=0x50) returned 1 [0061.242] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.242] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.242] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.242] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0061.242] FindFirstFileA (in: lpFileName="C:\\\\Boot\\pt-PT\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2eac9e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2eac9e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287a0 [0061.242] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2eac9e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2eac9e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0061.242] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2eac9e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2eac9e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2eac9e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.242] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287e0 [0061.242] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628818 [0061.242] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628818 | out: hHeap=0x610000) returned 1 [0061.242] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.242] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.242] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287e0 | out: hHeap=0x610000) returned 1 [0061.242] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2eac9e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2eac9e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2eac9e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.242] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.242] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.242] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.242] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.242] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.242] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.243] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2eac9e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2eac9e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2eac9e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.243] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.243] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.243] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.243] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.243] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.243] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.243] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0061.243] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.243] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.243] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.243] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.243] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0061.243] FindClose (in: hFindFile=0x6287a0 | out: hFindFile=0x6287a0) returned 1 [0061.243] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0061.243] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0061.243] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.243] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.243] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.243] AreFileApisANSI () returned 1 [0061.243] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.243] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.243] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\ru-RU\\@@_README_@@.txt") returned 32 [0061.243] CreateFileW (lpFileName="C:\\\\Boot\\ru-RU\\@@_README_@@.txt" (normalized: "c:\\boot\\ru-ru\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.245] GetFileType (hFile=0x50) returned 0x1 [0061.245] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.245] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.245] GetLastError () returned 0x0 [0061.245] SetLastError (dwErrCode=0x0) [0061.245] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.246] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.246] CloseHandle (hObject=0x50) returned 1 [0061.246] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.246] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.246] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.246] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628cc8 [0061.246] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.246] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.246] AreFileApisANSI () returned 1 [0061.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0061.246] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x46) returned 0x628d00 [0061.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x628d00, cchWideChar=35 | out: lpWideCharStr="C:\\\\Boot\\ru-RU\\@@_ATTENTION_@@.txt") returned 35 [0061.246] CreateFileW (lpFileName="C:\\\\Boot\\ru-RU\\@@_ATTENTION_@@.txt" (normalized: "c:\\boot\\ru-ru\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.248] GetFileType (hFile=0x50) returned 0x1 [0061.248] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d00 | out: hHeap=0x610000) returned 1 [0061.248] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.248] GetLastError () returned 0x0 [0061.248] SetLastError (dwErrCode=0x0) [0061.248] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.249] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.249] CloseHandle (hObject=0x50) returned 1 [0061.249] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.249] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.249] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.249] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.249] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.249] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.249] AreFileApisANSI () returned 1 [0061.249] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.249] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.249] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\ru-RU\\@@_HELPER_@@.txt") returned 32 [0061.249] CreateFileW (lpFileName="C:\\\\Boot\\ru-RU\\@@_HELPER_@@.txt" (normalized: "c:\\boot\\ru-ru\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.250] GetFileType (hFile=0x50) returned 0x1 [0061.250] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.250] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.251] GetLastError () returned 0x0 [0061.251] SetLastError (dwErrCode=0x0) [0061.251] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.252] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.252] CloseHandle (hObject=0x50) returned 1 [0061.252] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.252] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.252] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.252] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0061.252] FindFirstFileA (in: lpFileName="C:\\\\Boot\\ru-RU\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2ed2b40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2ed2b40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287a0 [0061.252] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2ed2b40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2ed2b40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0061.252] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2eac9e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2eac9e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2eac9e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.252] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287e0 [0061.252] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628818 [0061.252] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628818 | out: hHeap=0x610000) returned 1 [0061.252] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.252] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.252] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287e0 | out: hHeap=0x610000) returned 1 [0061.252] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2ed2b40, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2ed2b40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2ed2b40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.252] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.252] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.252] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.252] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.252] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.252] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.252] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2eac9e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2eac9e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2eac9e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.253] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.253] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.253] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.253] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.253] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.253] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.253] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0061.253] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.253] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.253] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.253] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.253] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0061.253] FindClose (in: hFindFile=0x6287a0 | out: hFindFile=0x6287a0) returned 1 [0061.253] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0061.253] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0061.253] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.253] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.253] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.253] AreFileApisANSI () returned 1 [0061.253] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.253] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.253] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\sv-SE\\@@_README_@@.txt") returned 32 [0061.253] CreateFileW (lpFileName="C:\\\\Boot\\sv-SE\\@@_README_@@.txt" (normalized: "c:\\boot\\sv-se\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.254] GetFileType (hFile=0x50) returned 0x1 [0061.254] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.254] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.254] GetLastError () returned 0x0 [0061.254] SetLastError (dwErrCode=0x0) [0061.254] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.255] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.255] CloseHandle (hObject=0x50) returned 1 [0061.255] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.255] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.255] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.255] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628cc8 [0061.255] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.255] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.255] AreFileApisANSI () returned 1 [0061.255] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0061.255] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x46) returned 0x628d00 [0061.255] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x628d00, cchWideChar=35 | out: lpWideCharStr="C:\\\\Boot\\sv-SE\\@@_ATTENTION_@@.txt") returned 35 [0061.255] CreateFileW (lpFileName="C:\\\\Boot\\sv-SE\\@@_ATTENTION_@@.txt" (normalized: "c:\\boot\\sv-se\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.259] GetFileType (hFile=0x50) returned 0x1 [0061.259] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d00 | out: hHeap=0x610000) returned 1 [0061.259] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.259] GetLastError () returned 0x0 [0061.259] SetLastError (dwErrCode=0x0) [0061.259] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.260] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.260] CloseHandle (hObject=0x50) returned 1 [0061.260] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.260] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.260] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.260] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.260] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.260] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.261] AreFileApisANSI () returned 1 [0061.261] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.261] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.261] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\sv-SE\\@@_HELPER_@@.txt") returned 32 [0061.261] CreateFileW (lpFileName="C:\\\\Boot\\sv-SE\\@@_HELPER_@@.txt" (normalized: "c:\\boot\\sv-se\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.261] GetFileType (hFile=0x50) returned 0x1 [0061.261] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.261] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.261] GetLastError () returned 0x0 [0061.261] SetLastError (dwErrCode=0x0) [0061.261] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.262] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.262] CloseHandle (hObject=0x50) returned 1 [0061.262] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.262] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.262] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.262] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0061.262] FindFirstFileA (in: lpFileName="C:\\\\Boot\\sv-SE\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2ed2b40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2ed2b40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287a0 [0061.263] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2ed2b40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2ed2b40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0061.263] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2ed2b40, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2ed2b40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2ed2b40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.263] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287e0 [0061.263] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628818 [0061.263] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628818 | out: hHeap=0x610000) returned 1 [0061.263] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.263] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.263] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287e0 | out: hHeap=0x610000) returned 1 [0061.263] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2ed2b40, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2ed2b40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2ed2b40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.263] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.263] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.263] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.263] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.263] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.263] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.263] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2ed2b40, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2ed2b40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2ed2b40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.263] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.263] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.263] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.263] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.263] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.263] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.263] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0061.263] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.263] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.263] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.263] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.264] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0061.264] FindClose (in: hFindFile=0x6287a0 | out: hFindFile=0x6287a0) returned 1 [0061.264] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0061.264] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0061.264] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.264] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.264] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.264] AreFileApisANSI () returned 1 [0061.264] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.264] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.264] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\tr-TR\\@@_README_@@.txt") returned 32 [0061.264] CreateFileW (lpFileName="C:\\\\Boot\\tr-TR\\@@_README_@@.txt" (normalized: "c:\\boot\\tr-tr\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.266] GetFileType (hFile=0x50) returned 0x1 [0061.266] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.266] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.266] GetLastError () returned 0x0 [0061.266] SetLastError (dwErrCode=0x0) [0061.266] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.267] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.267] CloseHandle (hObject=0x50) returned 1 [0061.268] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.268] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.268] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.268] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628cc8 [0061.268] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.268] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.268] AreFileApisANSI () returned 1 [0061.268] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0061.268] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x46) returned 0x628d00 [0061.268] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x628d00, cchWideChar=35 | out: lpWideCharStr="C:\\\\Boot\\tr-TR\\@@_ATTENTION_@@.txt") returned 35 [0061.268] CreateFileW (lpFileName="C:\\\\Boot\\tr-TR\\@@_ATTENTION_@@.txt" (normalized: "c:\\boot\\tr-tr\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.270] GetFileType (hFile=0x50) returned 0x1 [0061.270] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d00 | out: hHeap=0x610000) returned 1 [0061.270] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.270] GetLastError () returned 0x0 [0061.270] SetLastError (dwErrCode=0x0) [0061.270] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.271] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.271] CloseHandle (hObject=0x50) returned 1 [0061.271] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.271] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.271] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.271] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.271] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.271] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.271] AreFileApisANSI () returned 1 [0061.271] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.272] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.272] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\tr-TR\\@@_HELPER_@@.txt") returned 32 [0061.272] CreateFileW (lpFileName="C:\\\\Boot\\tr-TR\\@@_HELPER_@@.txt" (normalized: "c:\\boot\\tr-tr\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.272] GetFileType (hFile=0x50) returned 0x1 [0061.273] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.273] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.273] GetLastError () returned 0x0 [0061.273] SetLastError (dwErrCode=0x0) [0061.273] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.274] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.274] CloseHandle (hObject=0x50) returned 1 [0061.274] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.274] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.274] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.274] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0061.274] FindFirstFileA (in: lpFileName="C:\\\\Boot\\tr-TR\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2ef8ca0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2ef8ca0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287a0 [0061.274] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2ef8ca0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2ef8ca0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0061.274] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2ef8ca0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2ef8ca0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2ef8ca0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.274] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287e0 [0061.274] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628818 [0061.274] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628818 | out: hHeap=0x610000) returned 1 [0061.274] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.274] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.274] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287e0 | out: hHeap=0x610000) returned 1 [0061.274] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2ef8ca0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2ef8ca0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2ef8ca0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.275] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.275] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.275] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.275] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.275] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.275] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.275] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2ef8ca0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2ef8ca0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2ef8ca0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.275] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.275] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.275] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.275] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.275] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.275] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.275] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0061.275] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.275] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.275] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.275] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.275] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0061.275] FindClose (in: hFindFile=0x6287a0 | out: hFindFile=0x6287a0) returned 1 [0061.275] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0061.275] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0061.275] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.275] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.275] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.275] AreFileApisANSI () returned 1 [0061.275] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.275] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.275] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\zh-CN\\@@_README_@@.txt") returned 32 [0061.275] CreateFileW (lpFileName="C:\\\\Boot\\zh-CN\\@@_README_@@.txt" (normalized: "c:\\boot\\zh-cn\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.276] GetFileType (hFile=0x50) returned 0x1 [0061.276] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.276] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.276] GetLastError () returned 0x0 [0061.276] SetLastError (dwErrCode=0x0) [0061.276] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.277] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.277] CloseHandle (hObject=0x50) returned 1 [0061.277] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.277] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.277] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.277] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628cc8 [0061.277] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.277] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.277] AreFileApisANSI () returned 1 [0061.277] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0061.277] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x46) returned 0x628d00 [0061.277] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x628d00, cchWideChar=35 | out: lpWideCharStr="C:\\\\Boot\\zh-CN\\@@_ATTENTION_@@.txt") returned 35 [0061.277] CreateFileW (lpFileName="C:\\\\Boot\\zh-CN\\@@_ATTENTION_@@.txt" (normalized: "c:\\boot\\zh-cn\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.280] GetFileType (hFile=0x50) returned 0x1 [0061.280] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d00 | out: hHeap=0x610000) returned 1 [0061.280] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.280] GetLastError () returned 0x0 [0061.280] SetLastError (dwErrCode=0x0) [0061.280] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.282] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.282] CloseHandle (hObject=0x50) returned 1 [0061.282] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.282] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.282] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.282] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.282] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.282] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.282] AreFileApisANSI () returned 1 [0061.282] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.282] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.282] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\zh-CN\\@@_HELPER_@@.txt") returned 32 [0061.282] CreateFileW (lpFileName="C:\\\\Boot\\zh-CN\\@@_HELPER_@@.txt" (normalized: "c:\\boot\\zh-cn\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.282] GetFileType (hFile=0x50) returned 0x1 [0061.282] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.283] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.283] GetLastError () returned 0x0 [0061.283] SetLastError (dwErrCode=0x0) [0061.283] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.284] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.284] CloseHandle (hObject=0x50) returned 1 [0061.284] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.284] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.284] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.284] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0061.284] FindFirstFileA (in: lpFileName="C:\\\\Boot\\zh-CN\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2f1ee00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2f1ee00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287a0 [0061.284] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2f1ee00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2f1ee00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0061.284] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2ef8ca0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2ef8ca0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2f1ee00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.284] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287e0 [0061.284] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628818 [0061.284] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628818 | out: hHeap=0x610000) returned 1 [0061.284] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.284] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.284] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287e0 | out: hHeap=0x610000) returned 1 [0061.284] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f1ee00, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2f1ee00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2f1ee00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.284] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.284] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.284] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.285] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.285] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2ef8ca0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2ef8ca0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2ef8ca0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.285] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.285] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.285] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.285] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0061.285] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.285] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.285] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0061.285] FindClose (in: hFindFile=0x6287a0 | out: hFindFile=0x6287a0) returned 1 [0061.285] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0061.285] AreFileApisANSI () returned 1 [0061.285] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.285] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\zh-HK\\@@_README_@@.txt") returned 32 [0061.285] CreateFileW (lpFileName="C:\\\\Boot\\zh-HK\\@@_README_@@.txt" (normalized: "c:\\boot\\zh-hk\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.287] GetFileType (hFile=0x50) returned 0x1 [0061.287] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.287] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.287] GetLastError () returned 0x0 [0061.287] SetLastError (dwErrCode=0x0) [0061.287] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.288] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.288] CloseHandle (hObject=0x50) returned 1 [0061.288] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.288] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.288] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.288] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628cc8 [0061.288] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.288] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.288] AreFileApisANSI () returned 1 [0061.288] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0061.288] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x46) returned 0x628d00 [0061.288] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x628d00, cchWideChar=35 | out: lpWideCharStr="C:\\\\Boot\\zh-HK\\@@_ATTENTION_@@.txt") returned 35 [0061.288] CreateFileW (lpFileName="C:\\\\Boot\\zh-HK\\@@_ATTENTION_@@.txt" (normalized: "c:\\boot\\zh-hk\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.290] GetFileType (hFile=0x50) returned 0x1 [0061.290] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d00 | out: hHeap=0x610000) returned 1 [0061.290] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.290] GetLastError () returned 0x0 [0061.290] SetLastError (dwErrCode=0x0) [0061.290] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.291] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.291] CloseHandle (hObject=0x50) returned 1 [0061.292] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.292] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.292] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.292] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.292] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.292] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.292] AreFileApisANSI () returned 1 [0061.292] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.292] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.292] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\zh-HK\\@@_HELPER_@@.txt") returned 32 [0061.292] CreateFileW (lpFileName="C:\\\\Boot\\zh-HK\\@@_HELPER_@@.txt" (normalized: "c:\\boot\\zh-hk\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.293] GetFileType (hFile=0x50) returned 0x1 [0061.293] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.293] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.293] GetLastError () returned 0x0 [0061.293] SetLastError (dwErrCode=0x0) [0061.293] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.294] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.294] CloseHandle (hObject=0x50) returned 1 [0061.294] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.294] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.294] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.294] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0061.294] FindFirstFileA (in: lpFileName="C:\\\\Boot\\zh-HK\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2f1ee00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2f1ee00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287a0 [0061.295] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2f1ee00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2f1ee00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0061.295] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f1ee00, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2f1ee00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2f1ee00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.295] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287e0 [0061.295] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628818 [0061.295] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628818 | out: hHeap=0x610000) returned 1 [0061.295] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.295] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.295] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287e0 | out: hHeap=0x610000) returned 1 [0061.295] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f1ee00, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2f1ee00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2f1ee00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.295] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.295] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.295] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.295] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.295] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.295] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.295] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f1ee00, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2f1ee00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2f1ee00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.295] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.295] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.295] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.295] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.295] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.295] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.295] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0061.295] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.295] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.295] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.295] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.295] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0061.295] FindClose (in: hFindFile=0x6287a0 | out: hFindFile=0x6287a0) returned 1 [0061.296] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0061.296] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0061.296] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.296] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.296] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.296] AreFileApisANSI () returned 1 [0061.296] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.296] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.296] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\zh-TW\\@@_README_@@.txt") returned 32 [0061.296] CreateFileW (lpFileName="C:\\\\Boot\\zh-TW\\@@_README_@@.txt" (normalized: "c:\\boot\\zh-tw\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.296] GetFileType (hFile=0x50) returned 0x1 [0061.296] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.296] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.296] GetLastError () returned 0x0 [0061.296] SetLastError (dwErrCode=0x0) [0061.296] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.298] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.298] CloseHandle (hObject=0x50) returned 1 [0061.298] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.298] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.298] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.298] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628cc8 [0061.298] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.298] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.298] AreFileApisANSI () returned 1 [0061.298] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0061.298] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x46) returned 0x628d00 [0061.298] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x628d00, cchWideChar=35 | out: lpWideCharStr="C:\\\\Boot\\zh-TW\\@@_ATTENTION_@@.txt") returned 35 [0061.298] CreateFileW (lpFileName="C:\\\\Boot\\zh-TW\\@@_ATTENTION_@@.txt" (normalized: "c:\\boot\\zh-tw\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.301] GetFileType (hFile=0x50) returned 0x1 [0061.301] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d00 | out: hHeap=0x610000) returned 1 [0061.301] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.301] GetLastError () returned 0x0 [0061.301] SetLastError (dwErrCode=0x0) [0061.301] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.302] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.302] CloseHandle (hObject=0x50) returned 1 [0061.302] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.302] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.302] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.302] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.302] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623ec0 [0061.302] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.302] AreFileApisANSI () returned 1 [0061.302] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.302] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628cc8 [0061.302] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=32 | out: lpWideCharStr="C:\\\\Boot\\zh-TW\\@@_HELPER_@@.txt") returned 32 [0061.302] CreateFileW (lpFileName="C:\\\\Boot\\zh-TW\\@@_HELPER_@@.txt" (normalized: "c:\\boot\\zh-tw\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.303] GetFileType (hFile=0x50) returned 0x1 [0061.303] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.303] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62c568 [0061.303] GetLastError () returned 0x0 [0061.303] SetLastError (dwErrCode=0x0) [0061.303] WriteFile (in: hFile=0x50, lpBuffer=0x18cb34*, nNumberOfBytesToWrite=0x563, lpNumberOfBytesWritten=0x18cb2c, lpOverlapped=0x0 | out: lpBuffer=0x18cb34*, lpNumberOfBytesWritten=0x18cb2c*=0x563, lpOverlapped=0x0) returned 1 [0061.304] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62c568 | out: hHeap=0x610000) returned 1 [0061.304] CloseHandle (hObject=0x50) returned 1 [0061.304] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.304] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ec0 | out: hHeap=0x610000) returned 1 [0061.304] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.304] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0061.304] FindFirstFileA (in: lpFileName="C:\\\\Boot\\zh-TW\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2f44f60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2f44f60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287a0 [0061.304] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xe2f44f60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2f44f60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0061.304] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f44f60, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2f44f60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2f44f60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.304] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287e0 [0061.304] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628818 [0061.305] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628818 | out: hHeap=0x610000) returned 1 [0061.305] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.305] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.305] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287e0 | out: hHeap=0x610000) returned 1 [0061.305] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f44f60, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2f44f60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2f44f60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.305] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.305] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.305] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.305] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.305] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.305] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.305] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f1ee00, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2f1ee00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2f44f60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.305] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.305] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.305] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.305] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.305] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.305] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.305] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0061.305] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.305] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.305] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.305] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.305] FindNextFileA (in: hFindFile=0x6287a0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x610000, dwReserved1=0x628810, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0061.305] FindClose (in: hFindFile=0x6287a0 | out: hFindFile=0x6287a0) returned 1 [0061.305] FindNextFileA (in: hFindFile=0x623e80, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0061.305] FindClose (in: hFindFile=0x623e80 | out: hFindFile=0x623e80) returned 1 [0061.305] FindNextFileA (in: hFindFile=0x623e20, lpFindFileData=0x18f490 | out: lpFindFileData=0x18f490*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x51000352, dwReserved1=0xdc, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0061.305] FindNextFileA (in: hFindFile=0x623e20, lpFindFileData=0x18f490 | out: lpFindFileData=0x18f490*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x51000352, dwReserved1=0xdc, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0061.305] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.306] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.306] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.306] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.306] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.306] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623e60 [0061.306] AreFileApisANSI () returned 1 [0061.306] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f9d0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0061.306] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x22) returned 0x623e70 [0061.306] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f9d0, cbMultiByte=-1, lpWideCharStr=0x623e70, cchWideChar=17 | out: lpWideCharStr="C:\\\\BOOTSECT.BAK") returned 17 [0061.306] CreateFileW (lpFileName="C:\\\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x18f144, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0061.322] GetLastError () returned 0x5 [0061.322] GetLastError () returned 0x5 [0061.322] SetLastError (dwErrCode=0x5) [0061.322] GetLastError () returned 0x5 [0061.322] SetLastError (dwErrCode=0x5) [0061.322] GetLastError () returned 0x5 [0061.322] SetLastError (dwErrCode=0x5) [0061.322] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e70 | out: hHeap=0x610000) returned 1 [0061.322] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e60 | out: hHeap=0x610000) returned 1 [0061.322] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.322] FindNextFileA (in: hFindFile=0x623e20, lpFindFileData=0x18f490 | out: lpFindFileData=0x18f490*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0061.322] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0061.322] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.322] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.322] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x623e60 [0061.322] AreFileApisANSI () returned 1 [0061.322] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.322] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x623e70 [0061.322] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x623e70, cchWideChar=32 | out: lpWideCharStr="C:\\\\Config.Msi\\@@_README_@@.txt") returned 32 [0061.322] CreateFileW (lpFileName="C:\\\\Config.Msi\\@@_README_@@.txt" (normalized: "c:\\config.msi\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e82c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c [0061.351] GetFileType (hFile=0x4c) returned 0x1 [0061.351] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e70 | out: hHeap=0x610000) returned 1 [0061.351] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x62b560 [0061.353] AreFileApisANSI () returned 1 [0061.353] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x623e60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0061.353] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x46) returned 0x628cc8 [0061.353] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x623e60, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=35 | out: lpWideCharStr="C:\\\\Config.Msi\\@@_ATTENTION_@@.txt") returned 35 [0061.353] CreateFileW (lpFileName="C:\\\\Config.Msi\\@@_ATTENTION_@@.txt" (normalized: "c:\\config.msi\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e82c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c [0061.354] GetFileType (hFile=0x4c) returned 0x1 [0061.354] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.354] AreFileApisANSI () returned 1 [0061.354] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0061.355] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x623e70 [0061.355] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x623e70, cchWideChar=32 | out: lpWideCharStr="C:\\\\Config.Msi\\@@_HELPER_@@.txt") returned 32 [0061.355] CreateFileW (lpFileName="C:\\\\Config.Msi\\@@_HELPER_@@.txt" (normalized: "c:\\config.msi\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e82c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c [0061.362] GetFileType (hFile=0x4c) returned 0x1 [0061.362] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e70 | out: hHeap=0x610000) returned 1 [0061.363] FindFirstFileA (in: lpFileName="C:\\\\Config.Msi\\*", lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xe2fdd4e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2fdd4e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x623e90 [0061.363] FindNextFileA (in: hFindFile=0x623e90, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xe2fdd4e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2fdd4e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0061.363] FindNextFileA (in: hFindFile=0x623e90, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2fb7380, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2fb7380, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2fb7380, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.363] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628770 [0061.363] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287a8 [0061.363] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287a8 | out: hHeap=0x610000) returned 1 [0061.363] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.363] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.363] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0061.363] FindNextFileA (in: hFindFile=0x623e90, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2fdd4e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2fdd4e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2fdd4e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6287a0, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.363] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.363] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.363] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.363] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.363] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.363] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.363] FindNextFileA (in: hFindFile=0x623e90, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f91220, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2f91220, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2fb7380, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6287a0, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.363] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.363] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.363] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.363] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.363] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.363] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.363] FindNextFileA (in: hFindFile=0x623e90, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f91220, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2f91220, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2fb7380, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6287a0, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 0 [0061.363] FindClose (in: hFindFile=0x623e90 | out: hFindFile=0x623e90) returned 1 [0061.363] FindNextFileA (in: hFindFile=0x623e20, lpFindFileData=0x18f490 | out: lpFindFileData=0x18f490*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7716387a, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0061.364] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.364] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.364] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624790 [0061.364] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.364] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624790 | out: hHeap=0x610000) returned 1 [0061.364] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.364] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.364] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0061.364] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624790 [0061.364] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x623e60 [0061.364] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624790 | out: hHeap=0x610000) returned 1 [0061.364] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.364] AreFileApisANSI () returned 1 [0061.364] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x623e60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 44 [0061.364] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x58) returned 0x628cc8 [0061.364] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x623e60, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=44 | out: lpWideCharStr="C:\\\\Documents and Settings\\@@_README_@@.txt") returned 44 [0061.364] CreateFileW (lpFileName="C:\\\\Documents and Settings\\@@_README_@@.txt" (normalized: "c:\\documents and settings\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e82c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c [0061.365] GetFileType (hFile=0x4c) returned 0x1 [0061.365] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.366] AreFileApisANSI () returned 1 [0061.366] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x623e60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 47 [0061.366] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x5e) returned 0x628cc8 [0061.366] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x623e60, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=47 | out: lpWideCharStr="C:\\\\Documents and Settings\\@@_ATTENTION_@@.txt") returned 47 [0061.366] CreateFileW (lpFileName="C:\\\\Documents and Settings\\@@_ATTENTION_@@.txt" (normalized: "c:\\documents and settings\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e82c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c [0061.367] GetFileType (hFile=0x4c) returned 0x1 [0061.367] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.368] AreFileApisANSI () returned 1 [0061.368] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x623e60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 44 [0061.368] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x58) returned 0x628cc8 [0061.368] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x623e60, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=44 | out: lpWideCharStr="C:\\\\Documents and Settings\\@@_HELPER_@@.txt") returned 44 [0061.368] CreateFileW (lpFileName="C:\\\\Documents and Settings\\@@_HELPER_@@.txt" (normalized: "c:\\documents and settings\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e82c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c [0061.368] GetFileType (hFile=0x4c) returned 0x1 [0061.368] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.369] FindFirstFileA (in: lpFileName="C:\\\\Documents and Settings\\*", lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f91220, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2f91220, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2fb7380, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6287a0, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 0xffffffff [0061.369] FindNextFileA (in: hFindFile=0x623e20, lpFindFileData=0x18f490 | out: lpFindFileData=0x18f490*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x7716387a, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0061.369] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.369] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624790 [0061.369] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624790 | out: hHeap=0x610000) returned 1 [0061.369] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.369] FindNextFileA (in: hFindFile=0x623e20, lpFindFileData=0x18f490 | out: lpFindFileData=0x18f490*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7716387a, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0061.369] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0061.369] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.369] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.369] AreFileApisANSI () returned 1 [0061.370] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 30 [0061.370] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x3c) returned 0x623e70 [0061.370] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x623e70, cchWideChar=30 | out: lpWideCharStr="C:\\\\MSOCache\\@@_README_@@.txt") returned 30 [0061.370] CreateFileW (lpFileName="C:\\\\MSOCache\\@@_README_@@.txt" (normalized: "c:\\msocache\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e82c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c [0061.371] GetFileType (hFile=0x4c) returned 0x1 [0061.371] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e70 | out: hHeap=0x610000) returned 1 [0061.371] AreFileApisANSI () returned 1 [0061.371] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x623e60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 33 [0061.371] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x42) returned 0x628cc8 [0061.372] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x623e60, cbMultiByte=-1, lpWideCharStr=0x628cc8, cchWideChar=33 | out: lpWideCharStr="C:\\\\MSOCache\\@@_ATTENTION_@@.txt") returned 33 [0061.372] CreateFileW (lpFileName="C:\\\\MSOCache\\@@_ATTENTION_@@.txt" (normalized: "c:\\msocache\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e82c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c [0061.372] GetFileType (hFile=0x4c) returned 0x1 [0061.372] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628cc8 | out: hHeap=0x610000) returned 1 [0061.373] AreFileApisANSI () returned 1 [0061.373] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 30 [0061.373] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x3c) returned 0x623e70 [0061.373] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624740, cbMultiByte=-1, lpWideCharStr=0x623e70, cchWideChar=30 | out: lpWideCharStr="C:\\\\MSOCache\\@@_HELPER_@@.txt") returned 30 [0061.373] CreateFileW (lpFileName="C:\\\\MSOCache\\@@_HELPER_@@.txt" (normalized: "c:\\msocache\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e82c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c [0061.375] GetFileType (hFile=0x4c) returned 0x1 [0061.375] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623e70 | out: hHeap=0x610000) returned 1 [0061.376] FindFirstFileA (in: lpFileName="C:\\\\MSOCache\\*", lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe3003640, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3003640, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x623e60 [0061.376] FindNextFileA (in: hFindFile=0x623e60, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe3003640, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3003640, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0061.376] FindNextFileA (in: hFindFile=0x623e60, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe2fdd4e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2fdd4e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2fdd4e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x54000551, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.376] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628770 [0061.376] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287a8 [0061.376] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287a8 | out: hHeap=0x610000) returned 1 [0061.376] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.376] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.376] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0061.376] FindNextFileA (in: hFindFile=0x623e60, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe2fdd4e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2fdd4e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3003640, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6287a0, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.376] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.376] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624790 [0061.376] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624790 | out: hHeap=0x610000) returned 1 [0061.377] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624790 [0061.377] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624790 | out: hHeap=0x610000) returned 1 [0061.377] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.377] FindNextFileA (in: hFindFile=0x623e60, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe2fdd4e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe2fdd4e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe2fdd4e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6287a0, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.377] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.377] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624790 [0061.377] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624790 | out: hHeap=0x610000) returned 1 [0061.377] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624790 [0061.377] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624790 | out: hHeap=0x610000) returned 1 [0061.377] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.377] FindNextFileA (in: hFindFile=0x623e60, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610000, dwReserved1=0x6287a0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0061.377] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.377] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624790 [0061.377] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.377] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624790 | out: hHeap=0x610000) returned 1 [0061.377] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.377] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.377] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.377] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628770 [0061.377] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.377] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628cc8 [0061.377] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.377] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.377] AreFileApisANSI () returned 1 [0061.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 40 [0061.377] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628d00 [0061.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x628d00, cchWideChar=40 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\@@_README_@@.txt") returned 40 [0061.377] CreateFileW (lpFileName="C:\\\\MSOCache\\All Users\\@@_README_@@.txt" (normalized: "c:\\msocache\\all users\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.380] GetFileType (hFile=0x50) returned 0x1 [0061.380] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d00 | out: hHeap=0x610000) returned 1 [0061.380] AreFileApisANSI () returned 1 [0061.380] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 43 [0061.380] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x56) returned 0x628d00 [0061.380] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x628d00, cchWideChar=43 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\@@_ATTENTION_@@.txt") returned 43 [0061.380] CreateFileW (lpFileName="C:\\\\MSOCache\\All Users\\@@_ATTENTION_@@.txt" (normalized: "c:\\msocache\\all users\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.381] GetFileType (hFile=0x50) returned 0x1 [0061.381] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d00 | out: hHeap=0x610000) returned 1 [0061.382] AreFileApisANSI () returned 1 [0061.382] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 40 [0061.382] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628d00 [0061.382] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x628d00, cchWideChar=40 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\@@_HELPER_@@.txt") returned 40 [0061.382] CreateFileW (lpFileName="C:\\\\MSOCache\\All Users\\@@_HELPER_@@.txt" (normalized: "c:\\msocache\\all users\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18dec8, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x50 [0061.382] GetFileType (hFile=0x50) returned 0x1 [0061.383] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d00 | out: hHeap=0x610000) returned 1 [0061.383] FindFirstFileA (in: lpFileName="C:\\\\MSOCache\\All Users\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe3003640, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3003640, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287b0 [0061.384] FindNextFileA (in: hFindFile=0x6287b0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe3003640, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3003640, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0061.384] FindNextFileA (in: hFindFile=0x6287b0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3003640, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3003640, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3003640, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x53000350, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.384] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628770 [0061.384] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287f0 [0061.384] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.384] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.384] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.384] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0061.384] FindNextFileA (in: hFindFile=0x6287b0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3003640, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3003640, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3003640, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6287e8, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.384] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628770 [0061.385] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287f0 [0061.385] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.385] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.385] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.385] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0061.385] FindNextFileA (in: hFindFile=0x6287b0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3003640, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3003640, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3003640, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6287e8, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.385] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x628770 [0061.385] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x30) returned 0x6287f0 [0061.385] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.385] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624740 [0061.385] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624740 | out: hHeap=0x610000) returned 1 [0061.385] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628770 | out: hHeap=0x610000) returned 1 [0061.385] FindNextFileA (in: hFindFile=0x6287b0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610000, dwReserved1=0x6287e8, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0061.385] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x6287f0 [0061.385] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628838 [0061.385] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628880 [0061.385] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628838 | out: hHeap=0x610000) returned 1 [0061.385] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628880 | out: hHeap=0x610000) returned 1 [0061.385] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.385] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x6287f0 [0061.385] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628838 [0061.385] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628d90 [0061.385] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x77) returned 0x62d570 [0061.385] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d90 | out: hHeap=0x610000) returned 1 [0061.385] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.385] AreFileApisANSI () returned 1 [0061.385] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.385] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa2) returned 0x628d90 [0061.385] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x628d90, cchWideChar=81 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\@@_README_@@.txt") returned 81 [0061.385] CreateFileW (lpFileName="C:\\\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\@@_README_@@.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d564, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54 [0061.388] GetFileType (hFile=0x54) returned 0x1 [0061.388] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d90 | out: hHeap=0x610000) returned 1 [0061.389] AreFileApisANSI () returned 1 [0061.389] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0061.389] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa8) returned 0x628d90 [0061.389] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x628d90, cchWideChar=84 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\@@_ATTENTION_@@.txt") returned 84 [0061.389] CreateFileW (lpFileName="C:\\\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\@@_ATTENTION_@@.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d564, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54 [0061.390] GetFileType (hFile=0x54) returned 0x1 [0061.390] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d90 | out: hHeap=0x610000) returned 1 [0061.390] AreFileApisANSI () returned 1 [0061.390] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.391] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa2) returned 0x628d90 [0061.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x628d90, cchWideChar=81 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\@@_HELPER_@@.txt") returned 81 [0061.391] CreateFileW (lpFileName="C:\\\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\@@_HELPER_@@.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d564, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54 [0061.391] GetFileType (hFile=0x54) returned 0x1 [0061.392] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d90 | out: hHeap=0x610000) returned 1 [0061.392] FindFirstFileA (in: lpFileName="C:\\\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe30297a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe30297a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a00053f, dwReserved1=0xcc, cFileName=".", cAlternateFileName="")) returned 0x628770 [0061.393] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe30297a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe30297a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a00053f, dwReserved1=0xcc, cFileName="..", cAlternateFileName="")) returned 1 [0061.393] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3003640, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3003640, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe30297a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x3a00053f, dwReserved1=0xcc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.393] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.393] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.393] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.393] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.393] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.393] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.393] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe30297a0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe30297a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe30297a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.393] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.393] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.393] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.393] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.393] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.393] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.393] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3003640, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3003640, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3003640, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.393] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.393] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.393] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.393] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.393] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.393] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.393] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0061.393] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.393] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.393] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.393] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.393] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0061.393] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.393] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.393] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.393] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.393] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0061.393] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.393] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.393] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.393] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.394] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.394] AreFileApisANSI () returned 1 [0061.394] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77 [0061.394] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x9a) returned 0x6287f0 [0061.394] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6287f0, cchWideChar=77 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 77 [0061.394] CreateFileW (lpFileName="C:\\\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x18d518, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x58 [0061.394] GetFileType (hFile=0x58) returned 0x1 [0061.395] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.395] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d564 | out: lpNewFilePointer=0x0) returned 1 [0061.395] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d518 | out: lpNewFilePointer=0x0) returned 1 [0061.395] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d54c | out: lpNewFilePointer=0x0) returned 1 [0061.395] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.395] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.395] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d54c | out: lpNewFilePointer=0x0) returned 1 [0061.395] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.395] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.395] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x61d, lpOverlapped=0x0) returned 1 [0061.397] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.397] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.397] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.397] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.397] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.397] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.397] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x615, lpOverlapped=0x0) returned 1 [0061.397] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.397] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.398] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.398] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.398] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.398] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.398] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.398] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.398] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x60d, lpOverlapped=0x0) returned 1 [0061.398] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.398] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.398] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.398] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.398] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.398] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.398] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x18, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.398] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.398] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x605, lpOverlapped=0x0) returned 1 [0061.399] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.399] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.399] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x18, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.399] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.399] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.399] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.399] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x20, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.399] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.399] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5fd, lpOverlapped=0x0) returned 1 [0061.399] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.399] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.399] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x20, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.399] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.399] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.399] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.400] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x28, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.400] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.400] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5f5, lpOverlapped=0x0) returned 1 [0061.400] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.400] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.400] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x28, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.400] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.400] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.400] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.400] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x30, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.400] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.400] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5ed, lpOverlapped=0x0) returned 1 [0061.400] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.400] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.400] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x30, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.400] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.401] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.401] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.401] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x38, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.401] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.401] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5e5, lpOverlapped=0x0) returned 1 [0061.401] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.401] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.401] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x38, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.401] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.401] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.401] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.401] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x40, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.401] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.401] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5dd, lpOverlapped=0x0) returned 1 [0061.401] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.401] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.402] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x40, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.402] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.402] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.402] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.402] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x48, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.402] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.402] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5d5, lpOverlapped=0x0) returned 1 [0061.402] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.402] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.402] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x48, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.402] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.402] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.402] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.402] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x50, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.402] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.403] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5cd, lpOverlapped=0x0) returned 1 [0061.403] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.403] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.403] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x50, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.403] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.403] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.403] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.403] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x58, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.403] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.403] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5c5, lpOverlapped=0x0) returned 1 [0061.403] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.403] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.403] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x58, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.403] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.403] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.404] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.404] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x60, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.404] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.404] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5bd, lpOverlapped=0x0) returned 1 [0061.404] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.404] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.404] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x60, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.404] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.404] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.404] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.404] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x68, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.404] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.404] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5b5, lpOverlapped=0x0) returned 1 [0061.404] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.404] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.405] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x68, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.405] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.405] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.405] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.405] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x70, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.405] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.405] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5ad, lpOverlapped=0x0) returned 1 [0061.405] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.405] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.405] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x70, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.405] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.405] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.405] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.405] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x78, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.405] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.406] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5a5, lpOverlapped=0x0) returned 1 [0061.406] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.406] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.406] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x78, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.406] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.406] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.406] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.406] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x80, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.406] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.406] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x59d, lpOverlapped=0x0) returned 1 [0061.406] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.406] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.406] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x80, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.406] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.406] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.407] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.407] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x88, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.407] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.407] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x595, lpOverlapped=0x0) returned 1 [0061.407] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.407] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.407] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x88, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.407] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.407] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.407] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.407] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x90, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.407] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.407] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x58d, lpOverlapped=0x0) returned 1 [0061.407] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.407] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.408] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x90, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.408] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.408] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.408] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.408] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x98, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.408] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.408] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x585, lpOverlapped=0x0) returned 1 [0061.408] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.408] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.408] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x98, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.408] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.408] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.408] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.408] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.408] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.408] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x57d, lpOverlapped=0x0) returned 1 [0061.409] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.409] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.409] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.409] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.409] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.409] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.409] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.409] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.409] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x575, lpOverlapped=0x0) returned 1 [0061.409] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.409] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.409] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.409] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.409] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.409] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.410] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.410] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.410] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x56d, lpOverlapped=0x0) returned 1 [0061.410] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.410] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.410] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.410] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.410] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.410] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.410] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.410] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.410] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x565, lpOverlapped=0x0) returned 1 [0061.410] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.410] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.410] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.411] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.411] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.411] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.411] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.411] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.411] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x55d, lpOverlapped=0x0) returned 1 [0061.411] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.411] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.411] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.411] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.411] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.411] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.411] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.411] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.411] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x555, lpOverlapped=0x0) returned 1 [0061.412] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.412] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.412] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.412] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.412] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.412] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.412] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.412] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.412] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x54d, lpOverlapped=0x0) returned 1 [0061.412] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.412] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.412] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.412] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.412] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.412] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.412] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.413] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.413] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x545, lpOverlapped=0x0) returned 1 [0061.413] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.413] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.413] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.413] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.413] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.413] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.413] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.413] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.413] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x53d, lpOverlapped=0x0) returned 1 [0061.413] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.413] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.413] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.413] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.414] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.414] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.414] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.414] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.414] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x535, lpOverlapped=0x0) returned 1 [0061.414] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.414] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.414] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.414] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.414] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.414] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.414] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xf0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.414] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.414] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x52d, lpOverlapped=0x0) returned 1 [0061.414] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.415] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.415] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xf0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.415] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.415] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x525, lpOverlapped=0x0) returned 1 [0061.415] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x51d, lpOverlapped=0x0) returned 1 [0061.415] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x515, lpOverlapped=0x0) returned 1 [0061.415] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x50d, lpOverlapped=0x0) returned 1 [0061.415] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x505, lpOverlapped=0x0) returned 1 [0061.415] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4fd, lpOverlapped=0x0) returned 1 [0061.415] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4f5, lpOverlapped=0x0) returned 1 [0061.415] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4ed, lpOverlapped=0x0) returned 1 [0061.415] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4e5, lpOverlapped=0x0) returned 1 [0061.415] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4dd, lpOverlapped=0x0) returned 1 [0061.415] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4d5, lpOverlapped=0x0) returned 1 [0061.416] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4cd, lpOverlapped=0x0) returned 1 [0061.416] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4c5, lpOverlapped=0x0) returned 1 [0061.416] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4bd, lpOverlapped=0x0) returned 1 [0061.416] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4b5, lpOverlapped=0x0) returned 1 [0061.416] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4ad, lpOverlapped=0x0) returned 1 [0061.416] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4a5, lpOverlapped=0x0) returned 1 [0061.416] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x49d, lpOverlapped=0x0) returned 1 [0061.416] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x495, lpOverlapped=0x0) returned 1 [0061.416] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x48d, lpOverlapped=0x0) returned 1 [0061.416] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x485, lpOverlapped=0x0) returned 1 [0061.416] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x47d, lpOverlapped=0x0) returned 1 [0061.416] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x475, lpOverlapped=0x0) returned 1 [0061.416] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x46d, lpOverlapped=0x0) returned 1 [0061.416] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x465, lpOverlapped=0x0) returned 1 [0061.416] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x45d, lpOverlapped=0x0) returned 1 [0061.417] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x455, lpOverlapped=0x0) returned 1 [0061.417] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x44d, lpOverlapped=0x0) returned 1 [0061.417] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x445, lpOverlapped=0x0) returned 1 [0061.417] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x43d, lpOverlapped=0x0) returned 1 [0061.417] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x435, lpOverlapped=0x0) returned 1 [0061.417] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x42d, lpOverlapped=0x0) returned 1 [0061.417] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x425, lpOverlapped=0x0) returned 1 [0061.417] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x41d, lpOverlapped=0x0) returned 1 [0061.417] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x415, lpOverlapped=0x0) returned 1 [0061.417] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x40d, lpOverlapped=0x0) returned 1 [0061.417] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x405, lpOverlapped=0x0) returned 1 [0061.417] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3fd, lpOverlapped=0x0) returned 1 [0061.417] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3f5, lpOverlapped=0x0) returned 1 [0061.417] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3ed, lpOverlapped=0x0) returned 1 [0061.417] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3e5, lpOverlapped=0x0) returned 1 [0061.418] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3dd, lpOverlapped=0x0) returned 1 [0061.418] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3d5, lpOverlapped=0x0) returned 1 [0061.418] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3cd, lpOverlapped=0x0) returned 1 [0061.418] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3c5, lpOverlapped=0x0) returned 1 [0061.418] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3bd, lpOverlapped=0x0) returned 1 [0061.418] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3b5, lpOverlapped=0x0) returned 1 [0061.418] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3ad, lpOverlapped=0x0) returned 1 [0061.418] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3a5, lpOverlapped=0x0) returned 1 [0061.418] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x39d, lpOverlapped=0x0) returned 1 [0061.418] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x395, lpOverlapped=0x0) returned 1 [0061.418] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x38d, lpOverlapped=0x0) returned 1 [0061.418] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x385, lpOverlapped=0x0) returned 1 [0061.418] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x37d, lpOverlapped=0x0) returned 1 [0061.418] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x375, lpOverlapped=0x0) returned 1 [0061.419] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x36d, lpOverlapped=0x0) returned 1 [0061.419] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x365, lpOverlapped=0x0) returned 1 [0061.419] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x35d, lpOverlapped=0x0) returned 1 [0061.419] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x355, lpOverlapped=0x0) returned 1 [0061.419] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x34d, lpOverlapped=0x0) returned 1 [0061.419] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x345, lpOverlapped=0x0) returned 1 [0061.419] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x33d, lpOverlapped=0x0) returned 1 [0061.419] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x335, lpOverlapped=0x0) returned 1 [0061.419] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x32d, lpOverlapped=0x0) returned 1 [0061.419] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x325, lpOverlapped=0x0) returned 1 [0061.419] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x31d, lpOverlapped=0x0) returned 1 [0061.419] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x315, lpOverlapped=0x0) returned 1 [0061.419] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x30d, lpOverlapped=0x0) returned 1 [0061.419] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x305, lpOverlapped=0x0) returned 1 [0061.419] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2fd, lpOverlapped=0x0) returned 1 [0061.420] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2f5, lpOverlapped=0x0) returned 1 [0061.420] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2ed, lpOverlapped=0x0) returned 1 [0061.420] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2e5, lpOverlapped=0x0) returned 1 [0061.420] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2dd, lpOverlapped=0x0) returned 1 [0061.420] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2d5, lpOverlapped=0x0) returned 1 [0061.420] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2cd, lpOverlapped=0x0) returned 1 [0061.420] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2c5, lpOverlapped=0x0) returned 1 [0061.420] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2bd, lpOverlapped=0x0) returned 1 [0061.420] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2b5, lpOverlapped=0x0) returned 1 [0061.420] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2ad, lpOverlapped=0x0) returned 1 [0061.420] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2a5, lpOverlapped=0x0) returned 1 [0061.420] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x29d, lpOverlapped=0x0) returned 1 [0061.420] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x295, lpOverlapped=0x0) returned 1 [0061.420] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x28d, lpOverlapped=0x0) returned 1 [0061.421] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x285, lpOverlapped=0x0) returned 1 [0061.421] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x27d, lpOverlapped=0x0) returned 1 [0061.421] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x275, lpOverlapped=0x0) returned 1 [0061.421] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x26d, lpOverlapped=0x0) returned 1 [0061.421] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x265, lpOverlapped=0x0) returned 1 [0061.421] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x25d, lpOverlapped=0x0) returned 1 [0061.421] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x255, lpOverlapped=0x0) returned 1 [0061.421] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x24d, lpOverlapped=0x0) returned 1 [0061.421] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x245, lpOverlapped=0x0) returned 1 [0061.421] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x23d, lpOverlapped=0x0) returned 1 [0061.421] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x235, lpOverlapped=0x0) returned 1 [0061.421] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x22d, lpOverlapped=0x0) returned 1 [0061.421] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x225, lpOverlapped=0x0) returned 1 [0061.421] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x21d, lpOverlapped=0x0) returned 1 [0061.422] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x215, lpOverlapped=0x0) returned 1 [0061.422] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x20d, lpOverlapped=0x0) returned 1 [0061.422] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x205, lpOverlapped=0x0) returned 1 [0061.422] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1fd, lpOverlapped=0x0) returned 1 [0061.422] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1f5, lpOverlapped=0x0) returned 1 [0061.422] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1ed, lpOverlapped=0x0) returned 1 [0061.422] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1e5, lpOverlapped=0x0) returned 1 [0061.422] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1dd, lpOverlapped=0x0) returned 1 [0061.422] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1d5, lpOverlapped=0x0) returned 1 [0061.422] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1cd, lpOverlapped=0x0) returned 1 [0061.422] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1c5, lpOverlapped=0x0) returned 1 [0061.422] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1bd, lpOverlapped=0x0) returned 1 [0061.422] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1b5, lpOverlapped=0x0) returned 1 [0061.422] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1ad, lpOverlapped=0x0) returned 1 [0061.422] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1a5, lpOverlapped=0x0) returned 1 [0061.423] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x19d, lpOverlapped=0x0) returned 1 [0061.423] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x195, lpOverlapped=0x0) returned 1 [0061.423] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x18d, lpOverlapped=0x0) returned 1 [0061.423] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x185, lpOverlapped=0x0) returned 1 [0061.423] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x17d, lpOverlapped=0x0) returned 1 [0061.423] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x175, lpOverlapped=0x0) returned 1 [0061.423] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x16d, lpOverlapped=0x0) returned 1 [0061.423] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x165, lpOverlapped=0x0) returned 1 [0061.423] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x15d, lpOverlapped=0x0) returned 1 [0061.423] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x155, lpOverlapped=0x0) returned 1 [0061.423] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x14d, lpOverlapped=0x0) returned 1 [0061.423] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x145, lpOverlapped=0x0) returned 1 [0061.423] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x13d, lpOverlapped=0x0) returned 1 [0061.423] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x135, lpOverlapped=0x0) returned 1 [0061.424] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x12d, lpOverlapped=0x0) returned 1 [0061.424] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x125, lpOverlapped=0x0) returned 1 [0061.424] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x11d, lpOverlapped=0x0) returned 1 [0061.424] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x115, lpOverlapped=0x0) returned 1 [0061.424] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x10d, lpOverlapped=0x0) returned 1 [0061.424] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x105, lpOverlapped=0x0) returned 1 [0061.424] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xfd, lpOverlapped=0x0) returned 1 [0061.424] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xf5, lpOverlapped=0x0) returned 1 [0061.424] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xed, lpOverlapped=0x0) returned 1 [0061.424] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xe5, lpOverlapped=0x0) returned 1 [0061.424] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xdd, lpOverlapped=0x0) returned 1 [0061.424] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xd5, lpOverlapped=0x0) returned 1 [0061.424] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xcd, lpOverlapped=0x0) returned 1 [0061.424] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xc5, lpOverlapped=0x0) returned 1 [0061.424] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xbd, lpOverlapped=0x0) returned 1 [0061.425] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xb5, lpOverlapped=0x0) returned 1 [0061.425] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xad, lpOverlapped=0x0) returned 1 [0061.425] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa5, lpOverlapped=0x0) returned 1 [0061.425] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x9d, lpOverlapped=0x0) returned 1 [0061.425] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x95, lpOverlapped=0x0) returned 1 [0061.425] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8d, lpOverlapped=0x0) returned 1 [0061.425] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x85, lpOverlapped=0x0) returned 1 [0061.425] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7d, lpOverlapped=0x0) returned 1 [0061.425] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x75, lpOverlapped=0x0) returned 1 [0061.425] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6d, lpOverlapped=0x0) returned 1 [0061.425] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x65, lpOverlapped=0x0) returned 1 [0061.425] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5d, lpOverlapped=0x0) returned 1 [0061.425] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x55, lpOverlapped=0x0) returned 1 [0061.425] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4d, lpOverlapped=0x0) returned 1 [0061.426] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x45, lpOverlapped=0x0) returned 1 [0061.426] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3d, lpOverlapped=0x0) returned 1 [0061.426] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x35, lpOverlapped=0x0) returned 1 [0061.426] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2d, lpOverlapped=0x0) returned 1 [0061.426] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x25, lpOverlapped=0x0) returned 1 [0061.426] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1d, lpOverlapped=0x0) returned 1 [0061.426] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x15, lpOverlapped=0x0) returned 1 [0061.426] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xd, lpOverlapped=0x0) returned 1 [0061.426] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5, lpOverlapped=0x0) returned 1 [0061.426] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x0, lpOverlapped=0x0) returned 1 [0061.426] AreFileApisANSI () returned 1 [0061.426] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77 [0061.426] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 86 [0061.426] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x146) returned 0x6288b0 [0061.426] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6288b0, cchWideChar=77 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 77 [0061.426] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x62894a, cchWideChar=86 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.isolated") returned 86 [0061.426] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.isolated"), dwFlags=0x2) returned 1 [0061.427] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288b0 | out: hHeap=0x610000) returned 1 [0061.427] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.427] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.427] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ea0 | out: hHeap=0x610000) returned 1 [0061.427] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.427] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0061.427] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.427] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.427] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.427] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.427] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.427] AreFileApisANSI () returned 1 [0061.427] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0061.427] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x94) returned 0x6287f0 [0061.427] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6287f0, cchWideChar=74 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 74 [0061.428] CreateFileW (lpFileName="C:\\\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x18d518, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x58 [0061.428] GetFileType (hFile=0x58) returned 0x1 [0061.428] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.429] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d564 | out: lpNewFilePointer=0x0) returned 1 [0061.429] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d518 | out: lpNewFilePointer=0x0) returned 1 [0061.429] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d54c | out: lpNewFilePointer=0x0) returned 1 [0061.429] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.429] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.429] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d54c | out: lpNewFilePointer=0x0) returned 1 [0061.429] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.429] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.429] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8f8, lpOverlapped=0x0) returned 1 [0061.431] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.431] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.431] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.431] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.431] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.431] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.431] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8f0, lpOverlapped=0x0) returned 1 [0061.431] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.431] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.431] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.431] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.431] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.431] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.432] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.432] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.432] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8e8, lpOverlapped=0x0) returned 1 [0061.432] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.432] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.432] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.432] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.432] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.432] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.432] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x18, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.432] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.432] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8e0, lpOverlapped=0x0) returned 1 [0061.432] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.432] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.432] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x18, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.432] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.433] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.433] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.433] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x20, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.433] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.433] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8d8, lpOverlapped=0x0) returned 1 [0061.433] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.433] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.433] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x20, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.433] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.433] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.433] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.433] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x28, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.433] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.433] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8d0, lpOverlapped=0x0) returned 1 [0061.433] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.434] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.434] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x28, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.434] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.434] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.434] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.434] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x30, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.434] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.434] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8c8, lpOverlapped=0x0) returned 1 [0061.434] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.434] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.434] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x30, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.434] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.434] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.434] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.434] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x38, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.435] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.435] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8c0, lpOverlapped=0x0) returned 1 [0061.435] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.435] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.435] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x38, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.435] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.435] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.435] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.435] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x40, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.435] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.435] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8b8, lpOverlapped=0x0) returned 1 [0061.435] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.435] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.435] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x40, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.435] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.436] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.436] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.436] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x48, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.436] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.436] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8b0, lpOverlapped=0x0) returned 1 [0061.436] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.436] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.436] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x48, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.436] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.436] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.436] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.436] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x50, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.436] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.436] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8a8, lpOverlapped=0x0) returned 1 [0061.436] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.436] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.437] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x50, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.437] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.437] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.437] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.437] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x58, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.437] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.437] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8a0, lpOverlapped=0x0) returned 1 [0061.437] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.437] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.438] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x58, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.438] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.438] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.438] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.438] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x60, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.438] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.438] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x898, lpOverlapped=0x0) returned 1 [0061.438] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.438] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.438] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x60, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.438] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.438] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.438] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.438] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x68, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.439] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.439] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x890, lpOverlapped=0x0) returned 1 [0061.439] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.439] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.439] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x68, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.439] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.439] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.439] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.439] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x70, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.439] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.439] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x888, lpOverlapped=0x0) returned 1 [0061.439] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.439] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.439] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x70, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.439] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.439] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.440] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.440] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x78, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.440] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.440] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x880, lpOverlapped=0x0) returned 1 [0061.440] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.440] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.440] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x78, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.440] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.440] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.440] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.440] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x80, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.440] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.440] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x878, lpOverlapped=0x0) returned 1 [0061.440] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.440] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.441] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x80, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.441] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.441] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.441] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.441] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x88, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.441] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.441] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x870, lpOverlapped=0x0) returned 1 [0061.441] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.441] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.441] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x88, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.441] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.441] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.441] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.441] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x90, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.441] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.442] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x868, lpOverlapped=0x0) returned 1 [0061.442] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.442] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.442] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x90, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.442] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.442] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.442] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.442] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x98, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.442] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.442] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x860, lpOverlapped=0x0) returned 1 [0061.442] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.442] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.442] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x98, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.442] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.442] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.442] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.443] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.443] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.443] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x858, lpOverlapped=0x0) returned 1 [0061.443] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.443] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.443] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.443] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.443] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.443] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.443] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.443] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.443] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x850, lpOverlapped=0x0) returned 1 [0061.443] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.443] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.443] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.444] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.444] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.444] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.444] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.444] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.444] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x848, lpOverlapped=0x0) returned 1 [0061.444] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.444] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.444] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.444] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.444] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.444] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.444] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.444] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.444] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x840, lpOverlapped=0x0) returned 1 [0061.445] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.445] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.445] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.445] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.445] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.445] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.445] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.445] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.445] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x838, lpOverlapped=0x0) returned 1 [0061.445] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.445] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.445] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.445] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.445] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.445] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.445] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.446] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.446] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x830, lpOverlapped=0x0) returned 1 [0061.446] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.446] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.446] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.446] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.446] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.446] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.446] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.446] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.446] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x828, lpOverlapped=0x0) returned 1 [0061.446] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.446] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.446] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.446] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.447] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.447] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.447] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.447] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.447] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x820, lpOverlapped=0x0) returned 1 [0061.447] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.447] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.447] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.447] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.447] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.447] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.447] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.447] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.447] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x818, lpOverlapped=0x0) returned 1 [0061.448] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.448] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.448] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.448] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.448] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.448] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.448] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.448] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.448] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x810, lpOverlapped=0x0) returned 1 [0061.448] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.448] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.448] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.448] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.448] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.448] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.448] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xf0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.449] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.449] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x808, lpOverlapped=0x0) returned 1 [0061.449] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.449] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.449] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xf0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.449] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x800, lpOverlapped=0x0) returned 1 [0061.449] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7f8, lpOverlapped=0x0) returned 1 [0061.449] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7f0, lpOverlapped=0x0) returned 1 [0061.449] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7e8, lpOverlapped=0x0) returned 1 [0061.449] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7e0, lpOverlapped=0x0) returned 1 [0061.449] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7d8, lpOverlapped=0x0) returned 1 [0061.449] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7d0, lpOverlapped=0x0) returned 1 [0061.449] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7c8, lpOverlapped=0x0) returned 1 [0061.449] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7c0, lpOverlapped=0x0) returned 1 [0061.450] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7b8, lpOverlapped=0x0) returned 1 [0061.450] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7b0, lpOverlapped=0x0) returned 1 [0061.450] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7a8, lpOverlapped=0x0) returned 1 [0061.450] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7a0, lpOverlapped=0x0) returned 1 [0061.450] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x798, lpOverlapped=0x0) returned 1 [0061.450] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x790, lpOverlapped=0x0) returned 1 [0061.450] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x788, lpOverlapped=0x0) returned 1 [0061.450] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x780, lpOverlapped=0x0) returned 1 [0061.450] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x778, lpOverlapped=0x0) returned 1 [0061.450] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x770, lpOverlapped=0x0) returned 1 [0061.450] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x768, lpOverlapped=0x0) returned 1 [0061.450] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x760, lpOverlapped=0x0) returned 1 [0061.450] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x758, lpOverlapped=0x0) returned 1 [0061.450] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x750, lpOverlapped=0x0) returned 1 [0061.451] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x748, lpOverlapped=0x0) returned 1 [0061.451] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x740, lpOverlapped=0x0) returned 1 [0061.451] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x738, lpOverlapped=0x0) returned 1 [0061.451] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x730, lpOverlapped=0x0) returned 1 [0061.451] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x728, lpOverlapped=0x0) returned 1 [0061.451] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x720, lpOverlapped=0x0) returned 1 [0061.451] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x718, lpOverlapped=0x0) returned 1 [0061.451] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x710, lpOverlapped=0x0) returned 1 [0061.451] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x708, lpOverlapped=0x0) returned 1 [0061.451] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x700, lpOverlapped=0x0) returned 1 [0061.451] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6f8, lpOverlapped=0x0) returned 1 [0061.451] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6f0, lpOverlapped=0x0) returned 1 [0061.451] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6e8, lpOverlapped=0x0) returned 1 [0061.451] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6e0, lpOverlapped=0x0) returned 1 [0061.452] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6d8, lpOverlapped=0x0) returned 1 [0061.452] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6d0, lpOverlapped=0x0) returned 1 [0061.452] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6c8, lpOverlapped=0x0) returned 1 [0061.452] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6c0, lpOverlapped=0x0) returned 1 [0061.452] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6b8, lpOverlapped=0x0) returned 1 [0061.452] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6b0, lpOverlapped=0x0) returned 1 [0061.452] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6a8, lpOverlapped=0x0) returned 1 [0061.452] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6a0, lpOverlapped=0x0) returned 1 [0061.452] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x698, lpOverlapped=0x0) returned 1 [0061.452] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x690, lpOverlapped=0x0) returned 1 [0061.452] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x688, lpOverlapped=0x0) returned 1 [0061.452] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x680, lpOverlapped=0x0) returned 1 [0061.452] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x678, lpOverlapped=0x0) returned 1 [0061.452] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x670, lpOverlapped=0x0) returned 1 [0061.452] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x668, lpOverlapped=0x0) returned 1 [0061.478] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x660, lpOverlapped=0x0) returned 1 [0061.478] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x658, lpOverlapped=0x0) returned 1 [0061.478] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x650, lpOverlapped=0x0) returned 1 [0061.478] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x648, lpOverlapped=0x0) returned 1 [0061.478] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x640, lpOverlapped=0x0) returned 1 [0061.478] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x638, lpOverlapped=0x0) returned 1 [0061.478] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x630, lpOverlapped=0x0) returned 1 [0061.478] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x628, lpOverlapped=0x0) returned 1 [0061.478] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x620, lpOverlapped=0x0) returned 1 [0061.478] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x618, lpOverlapped=0x0) returned 1 [0061.478] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x610, lpOverlapped=0x0) returned 1 [0061.478] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x608, lpOverlapped=0x0) returned 1 [0061.478] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x600, lpOverlapped=0x0) returned 1 [0061.478] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5f8, lpOverlapped=0x0) returned 1 [0061.479] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5f0, lpOverlapped=0x0) returned 1 [0061.479] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5e8, lpOverlapped=0x0) returned 1 [0061.479] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5e0, lpOverlapped=0x0) returned 1 [0061.479] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5d8, lpOverlapped=0x0) returned 1 [0061.479] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5d0, lpOverlapped=0x0) returned 1 [0061.479] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5c8, lpOverlapped=0x0) returned 1 [0061.479] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5c0, lpOverlapped=0x0) returned 1 [0061.479] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5b8, lpOverlapped=0x0) returned 1 [0061.479] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5b0, lpOverlapped=0x0) returned 1 [0061.479] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5a8, lpOverlapped=0x0) returned 1 [0061.479] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5a0, lpOverlapped=0x0) returned 1 [0061.479] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x598, lpOverlapped=0x0) returned 1 [0061.479] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x590, lpOverlapped=0x0) returned 1 [0061.479] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x588, lpOverlapped=0x0) returned 1 [0061.480] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x580, lpOverlapped=0x0) returned 1 [0061.480] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x578, lpOverlapped=0x0) returned 1 [0061.480] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x570, lpOverlapped=0x0) returned 1 [0061.480] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x568, lpOverlapped=0x0) returned 1 [0061.480] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x560, lpOverlapped=0x0) returned 1 [0061.480] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x558, lpOverlapped=0x0) returned 1 [0061.480] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x550, lpOverlapped=0x0) returned 1 [0061.480] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x548, lpOverlapped=0x0) returned 1 [0061.480] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x540, lpOverlapped=0x0) returned 1 [0061.480] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x538, lpOverlapped=0x0) returned 1 [0061.480] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x530, lpOverlapped=0x0) returned 1 [0061.480] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x528, lpOverlapped=0x0) returned 1 [0061.480] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x520, lpOverlapped=0x0) returned 1 [0061.480] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x518, lpOverlapped=0x0) returned 1 [0061.480] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x510, lpOverlapped=0x0) returned 1 [0061.481] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x508, lpOverlapped=0x0) returned 1 [0061.481] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x500, lpOverlapped=0x0) returned 1 [0061.481] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4f8, lpOverlapped=0x0) returned 1 [0061.481] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4f0, lpOverlapped=0x0) returned 1 [0061.481] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4e8, lpOverlapped=0x0) returned 1 [0061.481] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4e0, lpOverlapped=0x0) returned 1 [0061.481] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4d8, lpOverlapped=0x0) returned 1 [0061.481] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4d0, lpOverlapped=0x0) returned 1 [0061.481] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4c8, lpOverlapped=0x0) returned 1 [0061.481] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4c0, lpOverlapped=0x0) returned 1 [0061.481] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4b8, lpOverlapped=0x0) returned 1 [0061.481] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4b0, lpOverlapped=0x0) returned 1 [0061.481] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4a8, lpOverlapped=0x0) returned 1 [0061.481] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4a0, lpOverlapped=0x0) returned 1 [0061.482] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x498, lpOverlapped=0x0) returned 1 [0061.482] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x490, lpOverlapped=0x0) returned 1 [0061.482] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x488, lpOverlapped=0x0) returned 1 [0061.482] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x480, lpOverlapped=0x0) returned 1 [0061.482] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x478, lpOverlapped=0x0) returned 1 [0061.482] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x470, lpOverlapped=0x0) returned 1 [0061.482] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x468, lpOverlapped=0x0) returned 1 [0061.482] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x460, lpOverlapped=0x0) returned 1 [0061.482] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x458, lpOverlapped=0x0) returned 1 [0061.482] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x450, lpOverlapped=0x0) returned 1 [0061.482] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x448, lpOverlapped=0x0) returned 1 [0061.482] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x440, lpOverlapped=0x0) returned 1 [0061.482] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x438, lpOverlapped=0x0) returned 1 [0061.482] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x430, lpOverlapped=0x0) returned 1 [0061.483] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x428, lpOverlapped=0x0) returned 1 [0061.483] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x420, lpOverlapped=0x0) returned 1 [0061.483] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x418, lpOverlapped=0x0) returned 1 [0061.483] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x410, lpOverlapped=0x0) returned 1 [0061.483] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x408, lpOverlapped=0x0) returned 1 [0061.483] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x400, lpOverlapped=0x0) returned 1 [0061.483] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3f8, lpOverlapped=0x0) returned 1 [0061.483] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3f0, lpOverlapped=0x0) returned 1 [0061.483] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3e8, lpOverlapped=0x0) returned 1 [0061.483] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3e0, lpOverlapped=0x0) returned 1 [0061.483] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3d8, lpOverlapped=0x0) returned 1 [0061.483] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3d0, lpOverlapped=0x0) returned 1 [0061.483] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3c8, lpOverlapped=0x0) returned 1 [0061.483] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3c0, lpOverlapped=0x0) returned 1 [0061.484] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3b8, lpOverlapped=0x0) returned 1 [0061.484] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3b0, lpOverlapped=0x0) returned 1 [0061.484] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3a8, lpOverlapped=0x0) returned 1 [0061.484] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3a0, lpOverlapped=0x0) returned 1 [0061.484] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x398, lpOverlapped=0x0) returned 1 [0061.484] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x390, lpOverlapped=0x0) returned 1 [0061.484] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x388, lpOverlapped=0x0) returned 1 [0061.484] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x380, lpOverlapped=0x0) returned 1 [0061.484] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x378, lpOverlapped=0x0) returned 1 [0061.484] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x370, lpOverlapped=0x0) returned 1 [0061.484] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x368, lpOverlapped=0x0) returned 1 [0061.484] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x360, lpOverlapped=0x0) returned 1 [0061.484] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x358, lpOverlapped=0x0) returned 1 [0061.484] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x350, lpOverlapped=0x0) returned 1 [0061.485] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x348, lpOverlapped=0x0) returned 1 [0061.485] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x340, lpOverlapped=0x0) returned 1 [0061.485] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x338, lpOverlapped=0x0) returned 1 [0061.485] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x330, lpOverlapped=0x0) returned 1 [0061.485] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x328, lpOverlapped=0x0) returned 1 [0061.485] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x320, lpOverlapped=0x0) returned 1 [0061.485] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x318, lpOverlapped=0x0) returned 1 [0061.485] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x310, lpOverlapped=0x0) returned 1 [0061.485] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x308, lpOverlapped=0x0) returned 1 [0061.485] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x300, lpOverlapped=0x0) returned 1 [0061.485] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2f8, lpOverlapped=0x0) returned 1 [0061.485] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2f0, lpOverlapped=0x0) returned 1 [0061.485] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2e8, lpOverlapped=0x0) returned 1 [0061.485] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2e0, lpOverlapped=0x0) returned 1 [0061.485] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2d8, lpOverlapped=0x0) returned 1 [0061.486] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2d0, lpOverlapped=0x0) returned 1 [0061.486] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2c8, lpOverlapped=0x0) returned 1 [0061.486] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2c0, lpOverlapped=0x0) returned 1 [0061.486] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2b8, lpOverlapped=0x0) returned 1 [0061.486] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2b0, lpOverlapped=0x0) returned 1 [0061.486] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2a8, lpOverlapped=0x0) returned 1 [0061.486] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2a0, lpOverlapped=0x0) returned 1 [0061.486] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x298, lpOverlapped=0x0) returned 1 [0061.486] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x290, lpOverlapped=0x0) returned 1 [0061.486] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x288, lpOverlapped=0x0) returned 1 [0061.486] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x280, lpOverlapped=0x0) returned 1 [0061.486] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x278, lpOverlapped=0x0) returned 1 [0061.486] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x270, lpOverlapped=0x0) returned 1 [0061.486] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x268, lpOverlapped=0x0) returned 1 [0061.487] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x260, lpOverlapped=0x0) returned 1 [0061.487] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x258, lpOverlapped=0x0) returned 1 [0061.487] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x250, lpOverlapped=0x0) returned 1 [0061.487] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x248, lpOverlapped=0x0) returned 1 [0061.487] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x240, lpOverlapped=0x0) returned 1 [0061.487] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x238, lpOverlapped=0x0) returned 1 [0061.487] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x230, lpOverlapped=0x0) returned 1 [0061.487] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x228, lpOverlapped=0x0) returned 1 [0061.487] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x220, lpOverlapped=0x0) returned 1 [0061.487] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x218, lpOverlapped=0x0) returned 1 [0061.487] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x210, lpOverlapped=0x0) returned 1 [0061.487] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x208, lpOverlapped=0x0) returned 1 [0061.487] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x200, lpOverlapped=0x0) returned 1 [0061.487] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1f8, lpOverlapped=0x0) returned 1 [0061.487] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1f0, lpOverlapped=0x0) returned 1 [0061.488] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1e8, lpOverlapped=0x0) returned 1 [0061.488] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1e0, lpOverlapped=0x0) returned 1 [0061.488] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1d8, lpOverlapped=0x0) returned 1 [0061.488] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1d0, lpOverlapped=0x0) returned 1 [0061.488] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1c8, lpOverlapped=0x0) returned 1 [0061.488] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1c0, lpOverlapped=0x0) returned 1 [0061.488] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1b8, lpOverlapped=0x0) returned 1 [0061.488] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1b0, lpOverlapped=0x0) returned 1 [0061.488] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1a8, lpOverlapped=0x0) returned 1 [0061.488] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1a0, lpOverlapped=0x0) returned 1 [0061.488] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x198, lpOverlapped=0x0) returned 1 [0061.488] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x190, lpOverlapped=0x0) returned 1 [0061.488] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x188, lpOverlapped=0x0) returned 1 [0061.488] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x180, lpOverlapped=0x0) returned 1 [0061.489] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x178, lpOverlapped=0x0) returned 1 [0061.489] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x170, lpOverlapped=0x0) returned 1 [0061.489] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x168, lpOverlapped=0x0) returned 1 [0061.489] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x160, lpOverlapped=0x0) returned 1 [0061.489] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x158, lpOverlapped=0x0) returned 1 [0061.489] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x150, lpOverlapped=0x0) returned 1 [0061.489] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x148, lpOverlapped=0x0) returned 1 [0061.489] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x140, lpOverlapped=0x0) returned 1 [0061.489] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x138, lpOverlapped=0x0) returned 1 [0061.490] AreFileApisANSI () returned 1 [0061.490] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0061.490] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0061.490] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x13a) returned 0x6288b0 [0061.490] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6288b0, cchWideChar=74 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 74 [0061.490] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x628944, cchWideChar=83 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.isolated") returned 83 [0061.490] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.isolated"), dwFlags=0x2) returned 1 [0061.490] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288b0 | out: hHeap=0x610000) returned 1 [0061.490] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.490] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.490] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ea0 | out: hHeap=0x610000) returned 1 [0061.490] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.490] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0061.490] FindClose (in: hFindFile=0x628770 | out: hFindFile=0x628770) returned 1 [0061.491] FindNextFileA (in: hFindFile=0x6287b0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0061.491] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x6287f0 [0061.491] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628838 [0061.491] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628880 [0061.491] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628838 | out: hHeap=0x610000) returned 1 [0061.491] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628880 | out: hHeap=0x610000) returned 1 [0061.491] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.491] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x6287f0 [0061.491] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628838 [0061.491] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628d90 [0061.491] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x77) returned 0x62d570 [0061.491] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d90 | out: hHeap=0x610000) returned 1 [0061.491] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.491] AreFileApisANSI () returned 1 [0061.491] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.491] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa2) returned 0x628d90 [0061.491] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x628d90, cchWideChar=81 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\@@_README_@@.txt") returned 81 [0061.491] CreateFileW (lpFileName="C:\\\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\@@_README_@@.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d564, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54 [0061.493] GetFileType (hFile=0x54) returned 0x1 [0061.493] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d90 | out: hHeap=0x610000) returned 1 [0061.494] AreFileApisANSI () returned 1 [0061.494] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0061.494] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa8) returned 0x628d90 [0061.494] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x628d90, cchWideChar=84 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\@@_ATTENTION_@@.txt") returned 84 [0061.495] CreateFileW (lpFileName="C:\\\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\@@_ATTENTION_@@.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d564, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54 [0061.495] GetFileType (hFile=0x54) returned 0x1 [0061.495] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d90 | out: hHeap=0x610000) returned 1 [0061.496] AreFileApisANSI () returned 1 [0061.496] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.496] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa2) returned 0x628d90 [0061.496] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x628d90, cchWideChar=81 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\@@_HELPER_@@.txt") returned 81 [0061.496] CreateFileW (lpFileName="C:\\\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\@@_HELPER_@@.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d564, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54 [0061.496] GetFileType (hFile=0x54) returned 0x1 [0061.497] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d90 | out: hHeap=0x610000) returned 1 [0061.497] FindFirstFileA (in: lpFileName="C:\\\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe310dfe0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe310dfe0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a00053f, dwReserved1=0xcc, cFileName=".", cAlternateFileName="")) returned 0x628770 [0061.498] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe310dfe0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe310dfe0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a00053f, dwReserved1=0xcc, cFileName="..", cAlternateFileName="")) returned 1 [0061.498] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe310dfe0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe310dfe0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe310dfe0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x3a00053f, dwReserved1=0xcc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.498] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.498] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.498] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.498] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.498] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.498] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.498] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe310dfe0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe310dfe0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe310dfe0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.498] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.498] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.498] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.498] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.498] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.498] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.498] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe310dfe0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe310dfe0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe310dfe0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.498] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.498] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.498] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.498] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.498] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.498] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.498] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0061.498] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.498] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.498] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.498] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.498] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0061.498] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.498] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.498] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.498] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.498] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.498] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.498] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.499] AreFileApisANSI () returned 1 [0061.499] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 82 [0061.499] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa4) returned 0x6287f0 [0061.499] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6287f0, cchWideChar=82 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 82 [0061.499] CreateFileW (lpFileName="C:\\\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x18d518, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x58 [0061.499] GetFileType (hFile=0x58) returned 0x1 [0061.499] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.499] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d564 | out: lpNewFilePointer=0x0) returned 1 [0061.499] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d518 | out: lpNewFilePointer=0x0) returned 1 [0061.499] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d54c | out: lpNewFilePointer=0x0) returned 1 [0061.499] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.499] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.499] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d54c | out: lpNewFilePointer=0x0) returned 1 [0061.500] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.500] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.500] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5aa, lpOverlapped=0x0) returned 1 [0061.501] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.501] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.501] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.501] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.501] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.501] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.502] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5a2, lpOverlapped=0x0) returned 1 [0061.502] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.502] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.502] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.502] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.502] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.502] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.502] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.502] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.502] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x59a, lpOverlapped=0x0) returned 1 [0061.502] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.502] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.502] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.502] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.503] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.503] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.503] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x18, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.503] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.503] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x592, lpOverlapped=0x0) returned 1 [0061.503] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.503] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.503] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x18, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.503] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.503] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.503] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.503] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x20, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.503] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.503] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x58a, lpOverlapped=0x0) returned 1 [0061.503] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.504] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.504] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x20, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.504] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.504] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.504] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.504] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x28, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.504] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.504] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x582, lpOverlapped=0x0) returned 1 [0061.504] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.504] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.504] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x28, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.504] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.504] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.504] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.504] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x30, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.505] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.505] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x57a, lpOverlapped=0x0) returned 1 [0061.505] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.505] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.505] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x30, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.505] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.505] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.505] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.505] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x38, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.505] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.505] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x572, lpOverlapped=0x0) returned 1 [0061.505] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.505] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.505] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x38, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.505] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.506] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.506] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.506] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x40, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.506] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.506] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x56a, lpOverlapped=0x0) returned 1 [0061.506] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.506] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.506] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x40, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.506] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.506] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.506] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.506] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x48, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.506] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.506] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x562, lpOverlapped=0x0) returned 1 [0061.506] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.507] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.507] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x48, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.507] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.507] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.507] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.507] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x50, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.507] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.507] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x55a, lpOverlapped=0x0) returned 1 [0061.507] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.507] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.507] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x50, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.507] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.507] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.507] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.507] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x58, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.508] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.508] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x552, lpOverlapped=0x0) returned 1 [0061.508] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.508] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.508] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x58, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.508] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.508] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.508] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.508] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x60, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.508] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.508] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x54a, lpOverlapped=0x0) returned 1 [0061.508] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.508] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.508] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x60, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.508] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.509] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.509] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.509] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x68, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.509] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.509] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x542, lpOverlapped=0x0) returned 1 [0061.509] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.509] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.509] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x68, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.509] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.509] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.509] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.509] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x70, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.509] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.509] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x53a, lpOverlapped=0x0) returned 1 [0061.509] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.509] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.510] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x70, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.510] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.510] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.510] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.510] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x78, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.510] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.510] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x532, lpOverlapped=0x0) returned 1 [0061.510] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.510] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.510] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x78, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.510] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.510] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.510] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.510] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x80, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.510] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.511] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x52a, lpOverlapped=0x0) returned 1 [0061.511] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.511] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.511] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x80, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.511] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.511] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.511] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.511] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x88, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.511] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.511] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x522, lpOverlapped=0x0) returned 1 [0061.511] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.511] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.511] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x88, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.511] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.512] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.512] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.512] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x90, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.512] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.512] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x51a, lpOverlapped=0x0) returned 1 [0061.512] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.512] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.512] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x90, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.512] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.512] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.512] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.512] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x98, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.512] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.512] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x512, lpOverlapped=0x0) returned 1 [0061.512] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.512] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.513] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x98, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.513] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.513] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.513] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.513] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.513] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.513] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x50a, lpOverlapped=0x0) returned 1 [0061.513] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.513] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.513] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.513] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.513] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.513] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.513] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.513] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.514] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x502, lpOverlapped=0x0) returned 1 [0061.514] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.514] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.514] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.514] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.514] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.514] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.514] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.514] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.514] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4fa, lpOverlapped=0x0) returned 1 [0061.514] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.514] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.514] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.514] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.514] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.515] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.515] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.515] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.515] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4f2, lpOverlapped=0x0) returned 1 [0061.515] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.515] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.515] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.515] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.515] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.515] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.515] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.515] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.515] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4ea, lpOverlapped=0x0) returned 1 [0061.515] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.516] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.516] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.516] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.516] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.516] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.516] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.516] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.516] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4e2, lpOverlapped=0x0) returned 1 [0061.516] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.516] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.516] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.516] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.516] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.516] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.516] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.517] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.517] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4da, lpOverlapped=0x0) returned 1 [0061.517] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.517] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.517] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.517] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.517] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.517] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.517] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.517] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.517] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4d2, lpOverlapped=0x0) returned 1 [0061.517] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.517] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.517] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.517] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.517] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.518] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.518] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.518] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.518] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4ca, lpOverlapped=0x0) returned 1 [0061.518] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.518] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.518] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.518] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.518] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.518] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.518] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.518] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.518] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4c2, lpOverlapped=0x0) returned 1 [0061.518] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.519] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.519] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.519] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.519] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.519] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.519] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xf0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.519] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.519] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4ba, lpOverlapped=0x0) returned 1 [0061.519] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.519] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.519] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xf0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.519] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4b2, lpOverlapped=0x0) returned 1 [0061.519] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4aa, lpOverlapped=0x0) returned 1 [0061.519] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4a2, lpOverlapped=0x0) returned 1 [0061.519] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x49a, lpOverlapped=0x0) returned 1 [0061.520] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x492, lpOverlapped=0x0) returned 1 [0061.520] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x48a, lpOverlapped=0x0) returned 1 [0061.520] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x482, lpOverlapped=0x0) returned 1 [0061.520] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x47a, lpOverlapped=0x0) returned 1 [0061.520] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x472, lpOverlapped=0x0) returned 1 [0061.520] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x46a, lpOverlapped=0x0) returned 1 [0061.520] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x462, lpOverlapped=0x0) returned 1 [0061.520] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x45a, lpOverlapped=0x0) returned 1 [0061.520] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x452, lpOverlapped=0x0) returned 1 [0061.520] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x44a, lpOverlapped=0x0) returned 1 [0061.520] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x442, lpOverlapped=0x0) returned 1 [0061.520] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x43a, lpOverlapped=0x0) returned 1 [0061.520] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x432, lpOverlapped=0x0) returned 1 [0061.520] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x42a, lpOverlapped=0x0) returned 1 [0061.521] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x422, lpOverlapped=0x0) returned 1 [0061.521] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x41a, lpOverlapped=0x0) returned 1 [0061.521] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x412, lpOverlapped=0x0) returned 1 [0061.521] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x40a, lpOverlapped=0x0) returned 1 [0061.521] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x402, lpOverlapped=0x0) returned 1 [0061.521] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3fa, lpOverlapped=0x0) returned 1 [0061.521] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3f2, lpOverlapped=0x0) returned 1 [0061.521] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3ea, lpOverlapped=0x0) returned 1 [0061.521] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3e2, lpOverlapped=0x0) returned 1 [0061.521] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3da, lpOverlapped=0x0) returned 1 [0061.521] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3d2, lpOverlapped=0x0) returned 1 [0061.521] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3ca, lpOverlapped=0x0) returned 1 [0061.521] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3c2, lpOverlapped=0x0) returned 1 [0061.521] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3ba, lpOverlapped=0x0) returned 1 [0061.521] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3b2, lpOverlapped=0x0) returned 1 [0061.522] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3aa, lpOverlapped=0x0) returned 1 [0061.522] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3a2, lpOverlapped=0x0) returned 1 [0061.522] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x39a, lpOverlapped=0x0) returned 1 [0061.522] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x392, lpOverlapped=0x0) returned 1 [0061.522] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x38a, lpOverlapped=0x0) returned 1 [0061.522] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x382, lpOverlapped=0x0) returned 1 [0061.522] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x37a, lpOverlapped=0x0) returned 1 [0061.522] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x372, lpOverlapped=0x0) returned 1 [0061.522] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x36a, lpOverlapped=0x0) returned 1 [0061.522] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x362, lpOverlapped=0x0) returned 1 [0061.522] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x35a, lpOverlapped=0x0) returned 1 [0061.522] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x352, lpOverlapped=0x0) returned 1 [0061.522] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x34a, lpOverlapped=0x0) returned 1 [0061.522] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x342, lpOverlapped=0x0) returned 1 [0061.523] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x33a, lpOverlapped=0x0) returned 1 [0061.523] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x332, lpOverlapped=0x0) returned 1 [0061.523] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x32a, lpOverlapped=0x0) returned 1 [0061.523] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x322, lpOverlapped=0x0) returned 1 [0061.523] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x31a, lpOverlapped=0x0) returned 1 [0061.523] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x312, lpOverlapped=0x0) returned 1 [0061.523] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x30a, lpOverlapped=0x0) returned 1 [0061.523] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x302, lpOverlapped=0x0) returned 1 [0061.523] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2fa, lpOverlapped=0x0) returned 1 [0061.523] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2f2, lpOverlapped=0x0) returned 1 [0061.523] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2ea, lpOverlapped=0x0) returned 1 [0061.523] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2e2, lpOverlapped=0x0) returned 1 [0061.523] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2da, lpOverlapped=0x0) returned 1 [0061.523] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2d2, lpOverlapped=0x0) returned 1 [0061.524] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2ca, lpOverlapped=0x0) returned 1 [0061.524] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2c2, lpOverlapped=0x0) returned 1 [0061.524] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2ba, lpOverlapped=0x0) returned 1 [0061.524] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2b2, lpOverlapped=0x0) returned 1 [0061.524] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2aa, lpOverlapped=0x0) returned 1 [0061.524] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2a2, lpOverlapped=0x0) returned 1 [0061.524] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x29a, lpOverlapped=0x0) returned 1 [0061.524] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x292, lpOverlapped=0x0) returned 1 [0061.524] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x28a, lpOverlapped=0x0) returned 1 [0061.524] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x282, lpOverlapped=0x0) returned 1 [0061.524] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x27a, lpOverlapped=0x0) returned 1 [0061.524] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x272, lpOverlapped=0x0) returned 1 [0061.524] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x26a, lpOverlapped=0x0) returned 1 [0061.524] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x262, lpOverlapped=0x0) returned 1 [0061.524] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x25a, lpOverlapped=0x0) returned 1 [0061.525] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x252, lpOverlapped=0x0) returned 1 [0061.525] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x24a, lpOverlapped=0x0) returned 1 [0061.525] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x242, lpOverlapped=0x0) returned 1 [0061.525] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x23a, lpOverlapped=0x0) returned 1 [0061.525] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x232, lpOverlapped=0x0) returned 1 [0061.525] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x22a, lpOverlapped=0x0) returned 1 [0061.525] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x222, lpOverlapped=0x0) returned 1 [0061.525] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x21a, lpOverlapped=0x0) returned 1 [0061.525] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x212, lpOverlapped=0x0) returned 1 [0061.525] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x20a, lpOverlapped=0x0) returned 1 [0061.525] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x202, lpOverlapped=0x0) returned 1 [0061.525] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1fa, lpOverlapped=0x0) returned 1 [0061.525] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1f2, lpOverlapped=0x0) returned 1 [0061.525] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1ea, lpOverlapped=0x0) returned 1 [0061.525] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1e2, lpOverlapped=0x0) returned 1 [0061.526] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1da, lpOverlapped=0x0) returned 1 [0061.526] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1d2, lpOverlapped=0x0) returned 1 [0061.526] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1ca, lpOverlapped=0x0) returned 1 [0061.526] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1c2, lpOverlapped=0x0) returned 1 [0061.526] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1ba, lpOverlapped=0x0) returned 1 [0061.526] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1b2, lpOverlapped=0x0) returned 1 [0061.526] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1aa, lpOverlapped=0x0) returned 1 [0061.526] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1a2, lpOverlapped=0x0) returned 1 [0061.526] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x19a, lpOverlapped=0x0) returned 1 [0061.526] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x192, lpOverlapped=0x0) returned 1 [0061.526] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x18a, lpOverlapped=0x0) returned 1 [0061.526] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x182, lpOverlapped=0x0) returned 1 [0061.526] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x17a, lpOverlapped=0x0) returned 1 [0061.526] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x172, lpOverlapped=0x0) returned 1 [0061.527] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x16a, lpOverlapped=0x0) returned 1 [0061.527] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x162, lpOverlapped=0x0) returned 1 [0061.527] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x15a, lpOverlapped=0x0) returned 1 [0061.527] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x152, lpOverlapped=0x0) returned 1 [0061.527] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x14a, lpOverlapped=0x0) returned 1 [0061.527] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x142, lpOverlapped=0x0) returned 1 [0061.527] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x13a, lpOverlapped=0x0) returned 1 [0061.527] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x132, lpOverlapped=0x0) returned 1 [0061.527] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x12a, lpOverlapped=0x0) returned 1 [0061.527] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x122, lpOverlapped=0x0) returned 1 [0061.527] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x11a, lpOverlapped=0x0) returned 1 [0061.527] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x112, lpOverlapped=0x0) returned 1 [0061.527] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x10a, lpOverlapped=0x0) returned 1 [0061.527] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x102, lpOverlapped=0x0) returned 1 [0061.528] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xfa, lpOverlapped=0x0) returned 1 [0061.528] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xf2, lpOverlapped=0x0) returned 1 [0061.528] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xea, lpOverlapped=0x0) returned 1 [0061.528] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xe2, lpOverlapped=0x0) returned 1 [0061.528] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xda, lpOverlapped=0x0) returned 1 [0061.528] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xd2, lpOverlapped=0x0) returned 1 [0061.528] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xca, lpOverlapped=0x0) returned 1 [0061.528] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xc2, lpOverlapped=0x0) returned 1 [0061.528] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xba, lpOverlapped=0x0) returned 1 [0061.528] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xb2, lpOverlapped=0x0) returned 1 [0061.528] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xaa, lpOverlapped=0x0) returned 1 [0061.528] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa2, lpOverlapped=0x0) returned 1 [0061.528] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x9a, lpOverlapped=0x0) returned 1 [0061.528] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x92, lpOverlapped=0x0) returned 1 [0061.528] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8a, lpOverlapped=0x0) returned 1 [0061.529] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x82, lpOverlapped=0x0) returned 1 [0061.529] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7a, lpOverlapped=0x0) returned 1 [0061.529] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x72, lpOverlapped=0x0) returned 1 [0061.529] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6a, lpOverlapped=0x0) returned 1 [0061.529] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x62, lpOverlapped=0x0) returned 1 [0061.529] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5a, lpOverlapped=0x0) returned 1 [0061.529] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x52, lpOverlapped=0x0) returned 1 [0061.529] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4a, lpOverlapped=0x0) returned 1 [0061.529] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x42, lpOverlapped=0x0) returned 1 [0061.529] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3a, lpOverlapped=0x0) returned 1 [0061.529] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x32, lpOverlapped=0x0) returned 1 [0061.529] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2a, lpOverlapped=0x0) returned 1 [0061.529] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x22, lpOverlapped=0x0) returned 1 [0061.529] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1a, lpOverlapped=0x0) returned 1 [0061.530] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x12, lpOverlapped=0x0) returned 1 [0061.530] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa, lpOverlapped=0x0) returned 1 [0061.530] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2, lpOverlapped=0x0) returned 1 [0061.530] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x0, lpOverlapped=0x0) returned 1 [0061.530] AreFileApisANSI () returned 1 [0061.530] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 82 [0061.530] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628858, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 91 [0061.530] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x15a) returned 0x6288c0 [0061.530] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6288c0, cchWideChar=82 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 82 [0061.530] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628858, cbMultiByte=-1, lpWideCharStr=0x628964, cchWideChar=91 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.isolated") returned 91 [0061.530] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.isolated"), dwFlags=0x2) returned 1 [0061.530] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288c0 | out: hHeap=0x610000) returned 1 [0061.530] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.531] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.531] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ea0 | out: hHeap=0x610000) returned 1 [0061.531] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.531] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0061.531] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.531] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.531] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.531] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.531] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0061.531] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.531] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.531] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.531] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.531] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.531] AreFileApisANSI () returned 1 [0061.531] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0061.531] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x94) returned 0x6287f0 [0061.531] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6287f0, cchWideChar=74 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 74 [0061.531] CreateFileW (lpFileName="C:\\\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x18d518, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x58 [0061.531] GetFileType (hFile=0x58) returned 0x1 [0061.531] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.531] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d564 | out: lpNewFilePointer=0x0) returned 1 [0061.532] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d518 | out: lpNewFilePointer=0x0) returned 1 [0061.532] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d54c | out: lpNewFilePointer=0x0) returned 1 [0061.532] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.532] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.532] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d54c | out: lpNewFilePointer=0x0) returned 1 [0061.532] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.532] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.532] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x75e, lpOverlapped=0x0) returned 1 [0061.533] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.534] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.534] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.534] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.534] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.534] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.534] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x756, lpOverlapped=0x0) returned 1 [0061.534] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.534] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.534] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.534] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.534] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.534] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.534] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.535] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.535] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x74e, lpOverlapped=0x0) returned 1 [0061.535] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.535] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.535] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.535] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.535] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.535] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.535] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x18, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.535] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.535] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x746, lpOverlapped=0x0) returned 1 [0061.535] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.535] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.535] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x18, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.535] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.536] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.536] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.536] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x20, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.536] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.536] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x73e, lpOverlapped=0x0) returned 1 [0061.536] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.536] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.536] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x20, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.536] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.536] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.536] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.536] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x28, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.536] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.536] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x736, lpOverlapped=0x0) returned 1 [0061.536] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.537] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.537] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x28, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.537] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.537] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.537] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.537] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x30, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.537] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.537] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x72e, lpOverlapped=0x0) returned 1 [0061.537] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.537] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.537] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x30, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.537] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.537] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.537] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.537] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x38, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.537] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.538] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x726, lpOverlapped=0x0) returned 1 [0061.538] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.538] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.538] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x38, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.538] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.538] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.538] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.538] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x40, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.538] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.538] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x71e, lpOverlapped=0x0) returned 1 [0061.538] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.538] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.538] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x40, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.538] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.539] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.539] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.539] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x48, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.539] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.539] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x716, lpOverlapped=0x0) returned 1 [0061.539] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.539] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.539] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x48, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.539] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.539] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.539] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.539] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x50, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.539] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.539] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x70e, lpOverlapped=0x0) returned 1 [0061.539] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.540] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.540] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x50, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.540] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.540] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.540] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.540] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x58, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.540] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.540] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x706, lpOverlapped=0x0) returned 1 [0061.540] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.540] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.540] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x58, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.540] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.540] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.540] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.540] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x60, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.541] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.541] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6fe, lpOverlapped=0x0) returned 1 [0061.541] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.541] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.541] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x60, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.541] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.541] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.541] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.541] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x68, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.541] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.541] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6f6, lpOverlapped=0x0) returned 1 [0061.541] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.541] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.541] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x68, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.541] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.541] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.542] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.542] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x70, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.542] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.542] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6ee, lpOverlapped=0x0) returned 1 [0061.542] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.542] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.542] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x70, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.542] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.542] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.542] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.542] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x78, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.542] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.542] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6e6, lpOverlapped=0x0) returned 1 [0061.542] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.542] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.543] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x78, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.543] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.543] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.543] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.543] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x80, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.543] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.543] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6de, lpOverlapped=0x0) returned 1 [0061.543] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.543] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.543] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x80, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.543] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.543] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.543] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.543] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x88, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.544] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.544] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6d6, lpOverlapped=0x0) returned 1 [0061.544] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.544] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.544] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x88, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.544] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.544] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.544] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.544] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x90, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.544] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.544] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6ce, lpOverlapped=0x0) returned 1 [0061.544] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.544] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.544] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x90, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.544] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.545] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.545] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.545] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x98, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.545] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.545] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6c6, lpOverlapped=0x0) returned 1 [0061.545] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.545] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.545] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x98, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.545] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.545] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.545] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.545] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.545] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.545] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6be, lpOverlapped=0x0) returned 1 [0061.545] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.545] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.546] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.546] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.546] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.546] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.546] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.546] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.546] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6b6, lpOverlapped=0x0) returned 1 [0061.546] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.546] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.546] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.546] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.546] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.546] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.546] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.547] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.547] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6ae, lpOverlapped=0x0) returned 1 [0061.547] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.547] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.547] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.547] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.547] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.547] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.547] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.547] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.547] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6a6, lpOverlapped=0x0) returned 1 [0061.547] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.547] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.547] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.547] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.548] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.548] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.548] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.548] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.548] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x69e, lpOverlapped=0x0) returned 1 [0061.548] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.548] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.548] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.548] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.548] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.548] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.548] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.548] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.548] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x696, lpOverlapped=0x0) returned 1 [0061.548] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.549] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.549] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.549] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.549] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.549] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.549] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.549] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.549] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x68e, lpOverlapped=0x0) returned 1 [0061.549] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.549] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.549] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.549] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.549] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.549] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.549] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.550] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.550] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x686, lpOverlapped=0x0) returned 1 [0061.550] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.550] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.550] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.550] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.550] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.550] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.550] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.550] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.550] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x67e, lpOverlapped=0x0) returned 1 [0061.550] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.550] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.550] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.550] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.551] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.551] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.551] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.551] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.551] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x676, lpOverlapped=0x0) returned 1 [0061.551] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.551] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.551] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.551] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.551] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.551] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.551] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xf0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.551] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.551] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x66e, lpOverlapped=0x0) returned 1 [0061.551] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.552] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.552] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xf0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.552] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x666, lpOverlapped=0x0) returned 1 [0061.552] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x65e, lpOverlapped=0x0) returned 1 [0061.552] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x656, lpOverlapped=0x0) returned 1 [0061.552] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x64e, lpOverlapped=0x0) returned 1 [0061.552] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x646, lpOverlapped=0x0) returned 1 [0061.552] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x63e, lpOverlapped=0x0) returned 1 [0061.552] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x636, lpOverlapped=0x0) returned 1 [0061.552] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x62e, lpOverlapped=0x0) returned 1 [0061.552] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x626, lpOverlapped=0x0) returned 1 [0061.552] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x61e, lpOverlapped=0x0) returned 1 [0061.552] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x616, lpOverlapped=0x0) returned 1 [0061.552] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x60e, lpOverlapped=0x0) returned 1 [0061.553] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x606, lpOverlapped=0x0) returned 1 [0061.553] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5fe, lpOverlapped=0x0) returned 1 [0061.553] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5f6, lpOverlapped=0x0) returned 1 [0061.553] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5ee, lpOverlapped=0x0) returned 1 [0061.553] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5e6, lpOverlapped=0x0) returned 1 [0061.553] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5de, lpOverlapped=0x0) returned 1 [0061.553] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5d6, lpOverlapped=0x0) returned 1 [0061.553] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5ce, lpOverlapped=0x0) returned 1 [0061.553] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5c6, lpOverlapped=0x0) returned 1 [0061.553] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5be, lpOverlapped=0x0) returned 1 [0061.553] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5b6, lpOverlapped=0x0) returned 1 [0061.553] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5ae, lpOverlapped=0x0) returned 1 [0061.553] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5a6, lpOverlapped=0x0) returned 1 [0061.553] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x59e, lpOverlapped=0x0) returned 1 [0061.553] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x596, lpOverlapped=0x0) returned 1 [0061.554] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x58e, lpOverlapped=0x0) returned 1 [0061.554] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x586, lpOverlapped=0x0) returned 1 [0061.554] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x57e, lpOverlapped=0x0) returned 1 [0061.554] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x576, lpOverlapped=0x0) returned 1 [0061.554] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x56e, lpOverlapped=0x0) returned 1 [0061.554] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x566, lpOverlapped=0x0) returned 1 [0061.554] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x55e, lpOverlapped=0x0) returned 1 [0061.554] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x556, lpOverlapped=0x0) returned 1 [0061.554] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x54e, lpOverlapped=0x0) returned 1 [0061.554] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x546, lpOverlapped=0x0) returned 1 [0061.554] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x53e, lpOverlapped=0x0) returned 1 [0061.554] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x536, lpOverlapped=0x0) returned 1 [0061.554] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x52e, lpOverlapped=0x0) returned 1 [0061.554] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x526, lpOverlapped=0x0) returned 1 [0061.555] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x51e, lpOverlapped=0x0) returned 1 [0061.555] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x516, lpOverlapped=0x0) returned 1 [0061.555] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x50e, lpOverlapped=0x0) returned 1 [0061.555] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x506, lpOverlapped=0x0) returned 1 [0061.555] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4fe, lpOverlapped=0x0) returned 1 [0061.555] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4f6, lpOverlapped=0x0) returned 1 [0061.555] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4ee, lpOverlapped=0x0) returned 1 [0061.555] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4e6, lpOverlapped=0x0) returned 1 [0061.555] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4de, lpOverlapped=0x0) returned 1 [0061.555] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4d6, lpOverlapped=0x0) returned 1 [0061.555] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4ce, lpOverlapped=0x0) returned 1 [0061.555] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4c6, lpOverlapped=0x0) returned 1 [0061.555] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4be, lpOverlapped=0x0) returned 1 [0061.555] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4b6, lpOverlapped=0x0) returned 1 [0061.556] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4ae, lpOverlapped=0x0) returned 1 [0061.556] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4a6, lpOverlapped=0x0) returned 1 [0061.556] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x49e, lpOverlapped=0x0) returned 1 [0061.556] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x496, lpOverlapped=0x0) returned 1 [0061.556] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x48e, lpOverlapped=0x0) returned 1 [0061.556] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x486, lpOverlapped=0x0) returned 1 [0061.556] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x47e, lpOverlapped=0x0) returned 1 [0061.556] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x476, lpOverlapped=0x0) returned 1 [0061.556] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x46e, lpOverlapped=0x0) returned 1 [0061.556] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x466, lpOverlapped=0x0) returned 1 [0061.556] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x45e, lpOverlapped=0x0) returned 1 [0061.556] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x456, lpOverlapped=0x0) returned 1 [0061.556] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x44e, lpOverlapped=0x0) returned 1 [0061.556] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x446, lpOverlapped=0x0) returned 1 [0061.556] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x43e, lpOverlapped=0x0) returned 1 [0061.557] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x436, lpOverlapped=0x0) returned 1 [0061.557] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x42e, lpOverlapped=0x0) returned 1 [0061.557] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x426, lpOverlapped=0x0) returned 1 [0061.557] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x41e, lpOverlapped=0x0) returned 1 [0061.557] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x416, lpOverlapped=0x0) returned 1 [0061.557] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x40e, lpOverlapped=0x0) returned 1 [0061.557] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x406, lpOverlapped=0x0) returned 1 [0061.557] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3fe, lpOverlapped=0x0) returned 1 [0061.557] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3f6, lpOverlapped=0x0) returned 1 [0061.557] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3ee, lpOverlapped=0x0) returned 1 [0061.557] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3e6, lpOverlapped=0x0) returned 1 [0061.557] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3de, lpOverlapped=0x0) returned 1 [0061.557] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3d6, lpOverlapped=0x0) returned 1 [0061.557] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3ce, lpOverlapped=0x0) returned 1 [0061.557] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3c6, lpOverlapped=0x0) returned 1 [0061.558] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3be, lpOverlapped=0x0) returned 1 [0061.558] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3b6, lpOverlapped=0x0) returned 1 [0061.558] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3ae, lpOverlapped=0x0) returned 1 [0061.558] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3a6, lpOverlapped=0x0) returned 1 [0061.558] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x39e, lpOverlapped=0x0) returned 1 [0061.558] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x396, lpOverlapped=0x0) returned 1 [0061.558] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x38e, lpOverlapped=0x0) returned 1 [0061.558] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x386, lpOverlapped=0x0) returned 1 [0061.558] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x37e, lpOverlapped=0x0) returned 1 [0061.558] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x376, lpOverlapped=0x0) returned 1 [0061.558] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x36e, lpOverlapped=0x0) returned 1 [0061.558] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x366, lpOverlapped=0x0) returned 1 [0061.558] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x35e, lpOverlapped=0x0) returned 1 [0061.558] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x356, lpOverlapped=0x0) returned 1 [0061.559] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x34e, lpOverlapped=0x0) returned 1 [0061.559] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x346, lpOverlapped=0x0) returned 1 [0061.559] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x33e, lpOverlapped=0x0) returned 1 [0061.559] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x336, lpOverlapped=0x0) returned 1 [0061.559] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x32e, lpOverlapped=0x0) returned 1 [0061.559] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x326, lpOverlapped=0x0) returned 1 [0061.559] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x31e, lpOverlapped=0x0) returned 1 [0061.559] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x316, lpOverlapped=0x0) returned 1 [0061.559] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x30e, lpOverlapped=0x0) returned 1 [0061.559] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x306, lpOverlapped=0x0) returned 1 [0061.559] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2fe, lpOverlapped=0x0) returned 1 [0061.559] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2f6, lpOverlapped=0x0) returned 1 [0061.559] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2ee, lpOverlapped=0x0) returned 1 [0061.559] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2e6, lpOverlapped=0x0) returned 1 [0061.560] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2de, lpOverlapped=0x0) returned 1 [0061.560] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2d6, lpOverlapped=0x0) returned 1 [0061.560] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2ce, lpOverlapped=0x0) returned 1 [0061.560] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2c6, lpOverlapped=0x0) returned 1 [0061.560] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2be, lpOverlapped=0x0) returned 1 [0061.560] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2b6, lpOverlapped=0x0) returned 1 [0061.560] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2ae, lpOverlapped=0x0) returned 1 [0061.560] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2a6, lpOverlapped=0x0) returned 1 [0061.560] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x29e, lpOverlapped=0x0) returned 1 [0061.560] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x296, lpOverlapped=0x0) returned 1 [0061.560] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x28e, lpOverlapped=0x0) returned 1 [0061.560] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x286, lpOverlapped=0x0) returned 1 [0061.560] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x27e, lpOverlapped=0x0) returned 1 [0061.560] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x276, lpOverlapped=0x0) returned 1 [0061.560] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x26e, lpOverlapped=0x0) returned 1 [0061.561] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x266, lpOverlapped=0x0) returned 1 [0061.561] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x25e, lpOverlapped=0x0) returned 1 [0061.561] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x256, lpOverlapped=0x0) returned 1 [0061.561] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x24e, lpOverlapped=0x0) returned 1 [0061.561] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x246, lpOverlapped=0x0) returned 1 [0061.561] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x23e, lpOverlapped=0x0) returned 1 [0061.561] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x236, lpOverlapped=0x0) returned 1 [0061.561] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x22e, lpOverlapped=0x0) returned 1 [0061.561] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x226, lpOverlapped=0x0) returned 1 [0061.561] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x21e, lpOverlapped=0x0) returned 1 [0061.561] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x216, lpOverlapped=0x0) returned 1 [0061.561] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x20e, lpOverlapped=0x0) returned 1 [0061.561] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x206, lpOverlapped=0x0) returned 1 [0061.561] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1fe, lpOverlapped=0x0) returned 1 [0061.562] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1f6, lpOverlapped=0x0) returned 1 [0061.562] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1ee, lpOverlapped=0x0) returned 1 [0061.562] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1e6, lpOverlapped=0x0) returned 1 [0061.562] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1de, lpOverlapped=0x0) returned 1 [0061.562] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1d6, lpOverlapped=0x0) returned 1 [0061.562] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1ce, lpOverlapped=0x0) returned 1 [0061.562] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1c6, lpOverlapped=0x0) returned 1 [0061.562] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1be, lpOverlapped=0x0) returned 1 [0061.562] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1b6, lpOverlapped=0x0) returned 1 [0061.562] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1ae, lpOverlapped=0x0) returned 1 [0061.562] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1a6, lpOverlapped=0x0) returned 1 [0061.563] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x19e, lpOverlapped=0x0) returned 1 [0061.563] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x196, lpOverlapped=0x0) returned 1 [0061.563] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x18e, lpOverlapped=0x0) returned 1 [0061.563] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x186, lpOverlapped=0x0) returned 1 [0061.563] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x17e, lpOverlapped=0x0) returned 1 [0061.563] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x176, lpOverlapped=0x0) returned 1 [0061.563] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x16e, lpOverlapped=0x0) returned 1 [0061.563] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x166, lpOverlapped=0x0) returned 1 [0061.563] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x15e, lpOverlapped=0x0) returned 1 [0061.563] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x156, lpOverlapped=0x0) returned 1 [0061.563] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x14e, lpOverlapped=0x0) returned 1 [0061.563] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x146, lpOverlapped=0x0) returned 1 [0061.563] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x13e, lpOverlapped=0x0) returned 1 [0061.563] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x136, lpOverlapped=0x0) returned 1 [0061.563] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x12e, lpOverlapped=0x0) returned 1 [0061.564] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x126, lpOverlapped=0x0) returned 1 [0061.564] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x11e, lpOverlapped=0x0) returned 1 [0061.564] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x116, lpOverlapped=0x0) returned 1 [0061.564] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x10e, lpOverlapped=0x0) returned 1 [0061.564] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x106, lpOverlapped=0x0) returned 1 [0061.564] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xfe, lpOverlapped=0x0) returned 1 [0061.564] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xf6, lpOverlapped=0x0) returned 1 [0061.564] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xee, lpOverlapped=0x0) returned 1 [0061.564] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xe6, lpOverlapped=0x0) returned 1 [0061.564] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xde, lpOverlapped=0x0) returned 1 [0061.564] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xd6, lpOverlapped=0x0) returned 1 [0061.564] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xce, lpOverlapped=0x0) returned 1 [0061.564] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xc6, lpOverlapped=0x0) returned 1 [0061.564] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xbe, lpOverlapped=0x0) returned 1 [0061.565] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xb6, lpOverlapped=0x0) returned 1 [0061.565] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xae, lpOverlapped=0x0) returned 1 [0061.565] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa6, lpOverlapped=0x0) returned 1 [0061.565] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x9e, lpOverlapped=0x0) returned 1 [0061.565] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x96, lpOverlapped=0x0) returned 1 [0061.565] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8e, lpOverlapped=0x0) returned 1 [0061.565] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x86, lpOverlapped=0x0) returned 1 [0061.565] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7e, lpOverlapped=0x0) returned 1 [0061.565] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x76, lpOverlapped=0x0) returned 1 [0061.565] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6e, lpOverlapped=0x0) returned 1 [0061.565] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x66, lpOverlapped=0x0) returned 1 [0061.565] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5e, lpOverlapped=0x0) returned 1 [0061.565] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x56, lpOverlapped=0x0) returned 1 [0061.565] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4e, lpOverlapped=0x0) returned 1 [0061.565] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x46, lpOverlapped=0x0) returned 1 [0061.566] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3e, lpOverlapped=0x0) returned 1 [0061.566] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x36, lpOverlapped=0x0) returned 1 [0061.566] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2e, lpOverlapped=0x0) returned 1 [0061.566] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x26, lpOverlapped=0x0) returned 1 [0061.566] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1e, lpOverlapped=0x0) returned 1 [0061.566] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x16, lpOverlapped=0x0) returned 1 [0061.566] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xe, lpOverlapped=0x0) returned 1 [0061.566] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6, lpOverlapped=0x0) returned 1 [0061.566] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x0, lpOverlapped=0x0) returned 1 [0061.566] AreFileApisANSI () returned 1 [0061.566] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0061.566] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0061.566] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x13a) returned 0x6288b0 [0061.566] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6288b0, cchWideChar=74 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 74 [0061.566] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x628944, cchWideChar=83 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.isolated") returned 83 [0061.566] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.isolated"), dwFlags=0x2) returned 1 [0061.567] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288b0 | out: hHeap=0x610000) returned 1 [0061.567] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.567] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.567] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ea0 | out: hHeap=0x610000) returned 1 [0061.567] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.567] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0061.567] FindClose (in: hFindFile=0x628770 | out: hFindFile=0x628770) returned 1 [0061.567] FindNextFileA (in: hFindFile=0x6287b0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0061.567] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x6287f0 [0061.567] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628838 [0061.567] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628880 [0061.567] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628838 | out: hHeap=0x610000) returned 1 [0061.567] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628880 | out: hHeap=0x610000) returned 1 [0061.567] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.567] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x6287f0 [0061.567] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628838 [0061.567] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628d90 [0061.567] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x77) returned 0x62d570 [0061.567] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d90 | out: hHeap=0x610000) returned 1 [0061.567] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.567] AreFileApisANSI () returned 1 [0061.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.568] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa2) returned 0x628d90 [0061.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x628d90, cchWideChar=81 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\@@_README_@@.txt") returned 81 [0061.568] CreateFileW (lpFileName="C:\\\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\@@_README_@@.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d564, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54 [0061.571] GetFileType (hFile=0x54) returned 0x1 [0061.571] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d90 | out: hHeap=0x610000) returned 1 [0061.572] AreFileApisANSI () returned 1 [0061.572] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0061.572] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa8) returned 0x628d90 [0061.572] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x628d90, cchWideChar=84 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\@@_ATTENTION_@@.txt") returned 84 [0061.572] CreateFileW (lpFileName="C:\\\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\@@_ATTENTION_@@.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d564, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54 [0061.572] GetFileType (hFile=0x54) returned 0x1 [0061.572] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d90 | out: hHeap=0x610000) returned 1 [0061.573] AreFileApisANSI () returned 1 [0061.573] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.573] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa2) returned 0x628d90 [0061.573] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x628d90, cchWideChar=81 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\@@_HELPER_@@.txt") returned 81 [0061.573] CreateFileW (lpFileName="C:\\\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\@@_HELPER_@@.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d564, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54 [0061.574] GetFileType (hFile=0x54) returned 0x1 [0061.574] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d90 | out: hHeap=0x610000) returned 1 [0061.575] FindFirstFileA (in: lpFileName="C:\\\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe31cc6c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe31cc6c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a00053f, dwReserved1=0xcc, cFileName=".", cAlternateFileName="")) returned 0x628770 [0061.575] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe31cc6c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe31cc6c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a00053f, dwReserved1=0xcc, cFileName="..", cAlternateFileName="")) returned 1 [0061.575] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe31cc6c0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe31cc6c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe31cc6c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x3a00053f, dwReserved1=0xcc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.575] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.575] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.575] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.575] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.575] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.575] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.575] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe31cc6c0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe31cc6c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe31cc6c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.575] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.575] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.575] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.575] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.575] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.575] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.575] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe31cc6c0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe31cc6c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe31cc6c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.575] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.575] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.575] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.575] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.575] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.576] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.576] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0061.576] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.576] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.576] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.576] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.576] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0061.576] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.576] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.576] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.576] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.576] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.576] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.576] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.576] AreFileApisANSI () returned 1 [0061.576] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.576] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa2) returned 0x6287f0 [0061.576] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6287f0, cchWideChar=81 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 81 [0061.576] CreateFileW (lpFileName="C:\\\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x18d518, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x58 [0061.577] GetFileType (hFile=0x58) returned 0x1 [0061.577] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.577] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d564 | out: lpNewFilePointer=0x0) returned 1 [0061.577] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d518 | out: lpNewFilePointer=0x0) returned 1 [0061.577] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d54c | out: lpNewFilePointer=0x0) returned 1 [0061.577] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.577] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.577] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d54c | out: lpNewFilePointer=0x0) returned 1 [0061.578] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.578] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.578] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5aa, lpOverlapped=0x0) returned 1 [0061.579] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.579] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.579] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.579] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.579] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.579] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.579] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5a2, lpOverlapped=0x0) returned 1 [0061.580] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.580] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.580] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.580] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.580] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.580] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.580] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.580] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.580] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x59a, lpOverlapped=0x0) returned 1 [0061.580] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.580] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.580] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.580] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.580] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.580] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.581] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x18, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.581] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.581] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x592, lpOverlapped=0x0) returned 1 [0061.581] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.581] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.581] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x18, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.581] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.581] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.581] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.581] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x20, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.581] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.581] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x58a, lpOverlapped=0x0) returned 1 [0061.581] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.581] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.581] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x20, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.581] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.582] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.582] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.582] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x28, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.582] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.582] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x582, lpOverlapped=0x0) returned 1 [0061.582] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.582] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.582] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x28, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.582] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.582] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.582] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.582] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x30, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.582] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.582] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x57a, lpOverlapped=0x0) returned 1 [0061.582] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.583] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.583] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x30, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.583] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.583] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.583] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.583] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x38, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.583] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.583] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x572, lpOverlapped=0x0) returned 1 [0061.583] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.583] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.583] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x38, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.583] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.583] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.583] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.584] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x40, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.584] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.584] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x56a, lpOverlapped=0x0) returned 1 [0061.584] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.584] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.584] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x40, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.584] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.584] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.584] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.584] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x48, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.584] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.584] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x562, lpOverlapped=0x0) returned 1 [0061.584] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.584] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.584] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x48, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.584] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.585] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.585] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.585] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x50, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.585] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.585] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x55a, lpOverlapped=0x0) returned 1 [0061.585] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.585] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.585] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x50, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.585] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.585] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.585] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.585] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x58, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.585] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.585] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x552, lpOverlapped=0x0) returned 1 [0061.585] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.586] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.586] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x58, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.586] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.586] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.586] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.586] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x60, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.586] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.586] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x54a, lpOverlapped=0x0) returned 1 [0061.586] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.586] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.586] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x60, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.586] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.586] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.586] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.586] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x68, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.587] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.587] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x542, lpOverlapped=0x0) returned 1 [0061.587] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.587] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.587] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x68, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.587] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.587] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.587] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.587] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x70, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.587] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.587] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x53a, lpOverlapped=0x0) returned 1 [0061.587] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.587] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.587] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x70, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.587] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.588] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.588] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.588] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x78, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.588] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.588] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x532, lpOverlapped=0x0) returned 1 [0061.588] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.588] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.588] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x78, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.588] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.588] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.588] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.588] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x80, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.588] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.588] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x52a, lpOverlapped=0x0) returned 1 [0061.588] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.589] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.589] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x80, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.589] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.589] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.589] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.589] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x88, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.589] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.589] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x522, lpOverlapped=0x0) returned 1 [0061.589] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.589] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.589] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x88, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.589] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.589] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.589] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.589] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x90, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.590] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.590] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x51a, lpOverlapped=0x0) returned 1 [0061.590] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.590] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.590] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x90, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.590] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.590] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.590] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.590] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x98, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.590] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.590] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x512, lpOverlapped=0x0) returned 1 [0061.590] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.590] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.590] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x98, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.590] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.591] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.591] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.591] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.591] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.591] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x50a, lpOverlapped=0x0) returned 1 [0061.591] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.591] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.591] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.591] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.591] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.591] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.591] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.591] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.591] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x502, lpOverlapped=0x0) returned 1 [0061.591] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.592] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.592] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.592] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.592] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.592] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.592] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.592] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.592] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4fa, lpOverlapped=0x0) returned 1 [0061.592] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.592] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.592] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.592] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.592] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.592] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.592] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.593] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.593] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4f2, lpOverlapped=0x0) returned 1 [0061.593] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.593] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.593] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.593] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.593] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.593] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.593] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.593] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.593] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4ea, lpOverlapped=0x0) returned 1 [0061.593] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.593] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.593] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.593] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.594] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.594] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.594] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.594] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.594] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4e2, lpOverlapped=0x0) returned 1 [0061.594] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.594] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.594] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.594] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.594] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.594] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.594] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.594] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.594] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4da, lpOverlapped=0x0) returned 1 [0061.595] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.595] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.595] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.595] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.595] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.595] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.595] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.595] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.595] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4d2, lpOverlapped=0x0) returned 1 [0061.595] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.595] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.595] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.595] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.595] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.595] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.596] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.596] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.596] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4ca, lpOverlapped=0x0) returned 1 [0061.596] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.596] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.596] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.596] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.596] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.596] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.596] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.596] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.596] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4c2, lpOverlapped=0x0) returned 1 [0061.596] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.596] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.596] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.597] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.597] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.597] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.597] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xf0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.597] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.597] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4ba, lpOverlapped=0x0) returned 1 [0061.597] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.597] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.597] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xf0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.597] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4b2, lpOverlapped=0x0) returned 1 [0061.597] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4aa, lpOverlapped=0x0) returned 1 [0061.597] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4a2, lpOverlapped=0x0) returned 1 [0061.597] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x49a, lpOverlapped=0x0) returned 1 [0061.597] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x492, lpOverlapped=0x0) returned 1 [0061.597] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x48a, lpOverlapped=0x0) returned 1 [0061.598] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x482, lpOverlapped=0x0) returned 1 [0061.598] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x47a, lpOverlapped=0x0) returned 1 [0061.598] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x472, lpOverlapped=0x0) returned 1 [0061.598] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x46a, lpOverlapped=0x0) returned 1 [0061.598] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x462, lpOverlapped=0x0) returned 1 [0061.598] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x45a, lpOverlapped=0x0) returned 1 [0061.598] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x452, lpOverlapped=0x0) returned 1 [0061.598] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x44a, lpOverlapped=0x0) returned 1 [0061.598] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x442, lpOverlapped=0x0) returned 1 [0061.598] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x43a, lpOverlapped=0x0) returned 1 [0061.598] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x432, lpOverlapped=0x0) returned 1 [0061.598] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x42a, lpOverlapped=0x0) returned 1 [0061.598] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x422, lpOverlapped=0x0) returned 1 [0061.598] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x41a, lpOverlapped=0x0) returned 1 [0061.599] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x412, lpOverlapped=0x0) returned 1 [0061.599] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x40a, lpOverlapped=0x0) returned 1 [0061.599] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x402, lpOverlapped=0x0) returned 1 [0061.599] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3fa, lpOverlapped=0x0) returned 1 [0061.599] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3f2, lpOverlapped=0x0) returned 1 [0061.599] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3ea, lpOverlapped=0x0) returned 1 [0061.599] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3e2, lpOverlapped=0x0) returned 1 [0061.599] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3da, lpOverlapped=0x0) returned 1 [0061.599] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3d2, lpOverlapped=0x0) returned 1 [0061.599] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3ca, lpOverlapped=0x0) returned 1 [0061.599] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3c2, lpOverlapped=0x0) returned 1 [0061.599] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3ba, lpOverlapped=0x0) returned 1 [0061.599] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3b2, lpOverlapped=0x0) returned 1 [0061.599] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3aa, lpOverlapped=0x0) returned 1 [0061.600] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3a2, lpOverlapped=0x0) returned 1 [0061.600] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x39a, lpOverlapped=0x0) returned 1 [0061.600] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x392, lpOverlapped=0x0) returned 1 [0061.600] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x38a, lpOverlapped=0x0) returned 1 [0061.600] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x382, lpOverlapped=0x0) returned 1 [0061.600] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x37a, lpOverlapped=0x0) returned 1 [0061.600] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x372, lpOverlapped=0x0) returned 1 [0061.600] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x36a, lpOverlapped=0x0) returned 1 [0061.600] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x362, lpOverlapped=0x0) returned 1 [0061.600] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x35a, lpOverlapped=0x0) returned 1 [0061.600] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x352, lpOverlapped=0x0) returned 1 [0061.600] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x34a, lpOverlapped=0x0) returned 1 [0061.600] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x342, lpOverlapped=0x0) returned 1 [0061.600] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x33a, lpOverlapped=0x0) returned 1 [0061.600] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x332, lpOverlapped=0x0) returned 1 [0061.601] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x32a, lpOverlapped=0x0) returned 1 [0061.601] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x322, lpOverlapped=0x0) returned 1 [0061.601] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x31a, lpOverlapped=0x0) returned 1 [0061.601] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x312, lpOverlapped=0x0) returned 1 [0061.601] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x30a, lpOverlapped=0x0) returned 1 [0061.601] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x302, lpOverlapped=0x0) returned 1 [0061.601] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2fa, lpOverlapped=0x0) returned 1 [0061.601] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2f2, lpOverlapped=0x0) returned 1 [0061.601] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2ea, lpOverlapped=0x0) returned 1 [0061.601] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2e2, lpOverlapped=0x0) returned 1 [0061.601] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2da, lpOverlapped=0x0) returned 1 [0061.601] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2d2, lpOverlapped=0x0) returned 1 [0061.601] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2ca, lpOverlapped=0x0) returned 1 [0061.601] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2c2, lpOverlapped=0x0) returned 1 [0061.601] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2ba, lpOverlapped=0x0) returned 1 [0061.602] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2b2, lpOverlapped=0x0) returned 1 [0061.602] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2aa, lpOverlapped=0x0) returned 1 [0061.602] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2a2, lpOverlapped=0x0) returned 1 [0061.602] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x29a, lpOverlapped=0x0) returned 1 [0061.602] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x292, lpOverlapped=0x0) returned 1 [0061.602] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x28a, lpOverlapped=0x0) returned 1 [0061.602] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x282, lpOverlapped=0x0) returned 1 [0061.602] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x27a, lpOverlapped=0x0) returned 1 [0061.602] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x272, lpOverlapped=0x0) returned 1 [0061.602] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x26a, lpOverlapped=0x0) returned 1 [0061.602] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x262, lpOverlapped=0x0) returned 1 [0061.602] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x25a, lpOverlapped=0x0) returned 1 [0061.602] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x252, lpOverlapped=0x0) returned 1 [0061.602] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x24a, lpOverlapped=0x0) returned 1 [0061.603] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x242, lpOverlapped=0x0) returned 1 [0061.603] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x23a, lpOverlapped=0x0) returned 1 [0061.603] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x232, lpOverlapped=0x0) returned 1 [0061.603] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x22a, lpOverlapped=0x0) returned 1 [0061.603] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x222, lpOverlapped=0x0) returned 1 [0061.603] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x21a, lpOverlapped=0x0) returned 1 [0061.603] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x212, lpOverlapped=0x0) returned 1 [0061.603] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x20a, lpOverlapped=0x0) returned 1 [0061.603] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x202, lpOverlapped=0x0) returned 1 [0061.603] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1fa, lpOverlapped=0x0) returned 1 [0061.603] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1f2, lpOverlapped=0x0) returned 1 [0061.603] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1ea, lpOverlapped=0x0) returned 1 [0061.603] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1e2, lpOverlapped=0x0) returned 1 [0061.603] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1da, lpOverlapped=0x0) returned 1 [0061.604] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1d2, lpOverlapped=0x0) returned 1 [0061.604] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1ca, lpOverlapped=0x0) returned 1 [0061.604] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1c2, lpOverlapped=0x0) returned 1 [0061.604] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1ba, lpOverlapped=0x0) returned 1 [0061.604] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1b2, lpOverlapped=0x0) returned 1 [0061.604] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1aa, lpOverlapped=0x0) returned 1 [0061.604] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1a2, lpOverlapped=0x0) returned 1 [0061.604] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x19a, lpOverlapped=0x0) returned 1 [0061.604] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x192, lpOverlapped=0x0) returned 1 [0061.604] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x18a, lpOverlapped=0x0) returned 1 [0061.604] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x182, lpOverlapped=0x0) returned 1 [0061.604] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x17a, lpOverlapped=0x0) returned 1 [0061.604] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x172, lpOverlapped=0x0) returned 1 [0061.604] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x16a, lpOverlapped=0x0) returned 1 [0061.604] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x162, lpOverlapped=0x0) returned 1 [0061.605] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x15a, lpOverlapped=0x0) returned 1 [0061.605] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x152, lpOverlapped=0x0) returned 1 [0061.605] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x14a, lpOverlapped=0x0) returned 1 [0061.605] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x142, lpOverlapped=0x0) returned 1 [0061.605] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x13a, lpOverlapped=0x0) returned 1 [0061.605] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x132, lpOverlapped=0x0) returned 1 [0061.605] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x12a, lpOverlapped=0x0) returned 1 [0061.605] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x122, lpOverlapped=0x0) returned 1 [0061.605] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x11a, lpOverlapped=0x0) returned 1 [0061.605] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x112, lpOverlapped=0x0) returned 1 [0061.605] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x10a, lpOverlapped=0x0) returned 1 [0061.605] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x102, lpOverlapped=0x0) returned 1 [0061.605] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xfa, lpOverlapped=0x0) returned 1 [0061.605] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xf2, lpOverlapped=0x0) returned 1 [0061.606] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xea, lpOverlapped=0x0) returned 1 [0061.606] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xe2, lpOverlapped=0x0) returned 1 [0061.606] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xda, lpOverlapped=0x0) returned 1 [0061.606] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xd2, lpOverlapped=0x0) returned 1 [0061.606] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xca, lpOverlapped=0x0) returned 1 [0061.606] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xc2, lpOverlapped=0x0) returned 1 [0061.606] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xba, lpOverlapped=0x0) returned 1 [0061.606] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xb2, lpOverlapped=0x0) returned 1 [0061.606] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xaa, lpOverlapped=0x0) returned 1 [0061.606] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa2, lpOverlapped=0x0) returned 1 [0061.606] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x9a, lpOverlapped=0x0) returned 1 [0061.606] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x92, lpOverlapped=0x0) returned 1 [0061.606] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8a, lpOverlapped=0x0) returned 1 [0061.606] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x82, lpOverlapped=0x0) returned 1 [0061.606] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7a, lpOverlapped=0x0) returned 1 [0061.607] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x72, lpOverlapped=0x0) returned 1 [0061.607] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6a, lpOverlapped=0x0) returned 1 [0061.607] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x62, lpOverlapped=0x0) returned 1 [0061.607] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5a, lpOverlapped=0x0) returned 1 [0061.607] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x52, lpOverlapped=0x0) returned 1 [0061.607] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4a, lpOverlapped=0x0) returned 1 [0061.607] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x42, lpOverlapped=0x0) returned 1 [0061.607] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3a, lpOverlapped=0x0) returned 1 [0061.607] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x32, lpOverlapped=0x0) returned 1 [0061.607] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2a, lpOverlapped=0x0) returned 1 [0061.607] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x22, lpOverlapped=0x0) returned 1 [0061.607] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1a, lpOverlapped=0x0) returned 1 [0061.607] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x12, lpOverlapped=0x0) returned 1 [0061.607] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa, lpOverlapped=0x0) returned 1 [0061.608] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2, lpOverlapped=0x0) returned 1 [0061.608] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x0, lpOverlapped=0x0) returned 1 [0061.608] AreFileApisANSI () returned 1 [0061.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628858, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 90 [0061.608] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x156) returned 0x6288c0 [0061.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6288c0, cchWideChar=81 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 81 [0061.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628858, cbMultiByte=-1, lpWideCharStr=0x628962, cchWideChar=90 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.isolated") returned 90 [0061.608] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.isolated"), dwFlags=0x2) returned 1 [0061.608] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288c0 | out: hHeap=0x610000) returned 1 [0061.608] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.608] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.608] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ea0 | out: hHeap=0x610000) returned 1 [0061.608] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.609] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0061.610] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.610] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.610] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.610] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.610] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0061.610] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.610] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.610] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.610] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.610] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.610] AreFileApisANSI () returned 1 [0061.610] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0061.610] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x94) returned 0x6287f0 [0061.610] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6287f0, cchWideChar=74 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 74 [0061.610] CreateFileW (lpFileName="C:\\\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x18d518, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x58 [0061.610] GetFileType (hFile=0x58) returned 0x1 [0061.610] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.610] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d564 | out: lpNewFilePointer=0x0) returned 1 [0061.610] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d518 | out: lpNewFilePointer=0x0) returned 1 [0061.610] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d54c | out: lpNewFilePointer=0x0) returned 1 [0061.611] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.611] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.611] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d54c | out: lpNewFilePointer=0x0) returned 1 [0061.611] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.611] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.611] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x648, lpOverlapped=0x0) returned 1 [0061.612] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.612] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.613] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.613] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.613] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.613] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.613] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x640, lpOverlapped=0x0) returned 1 [0061.613] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.613] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.613] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.613] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.613] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.613] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.613] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.613] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.613] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x638, lpOverlapped=0x0) returned 1 [0061.614] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.614] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.614] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.614] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.614] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.614] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.614] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x18, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.614] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.614] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x630, lpOverlapped=0x0) returned 1 [0061.614] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.614] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.614] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x18, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.614] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.614] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.615] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.615] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x20, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.615] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.615] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x628, lpOverlapped=0x0) returned 1 [0061.615] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.615] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.615] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x20, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.615] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.615] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.615] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.615] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x28, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.615] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.615] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x620, lpOverlapped=0x0) returned 1 [0061.615] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.615] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.616] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x28, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.616] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.616] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.616] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.616] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x30, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.616] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.616] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x618, lpOverlapped=0x0) returned 1 [0061.616] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.616] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.616] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x30, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.616] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.616] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.616] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.616] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x38, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.616] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.617] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x610, lpOverlapped=0x0) returned 1 [0061.617] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.617] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.617] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x38, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.617] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.617] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.617] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.617] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x40, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.617] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.617] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x608, lpOverlapped=0x0) returned 1 [0061.617] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.617] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.617] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x40, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.617] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.617] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.617] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.618] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x48, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.618] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.618] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x600, lpOverlapped=0x0) returned 1 [0061.618] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.618] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.618] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x48, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.618] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.618] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.618] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.618] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x50, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.618] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.618] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5f8, lpOverlapped=0x0) returned 1 [0061.618] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.618] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.618] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x50, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.619] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.619] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.619] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.619] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x58, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.619] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.619] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5f0, lpOverlapped=0x0) returned 1 [0061.619] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.619] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.619] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x58, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.619] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.619] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.619] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.619] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x60, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.619] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.620] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5e8, lpOverlapped=0x0) returned 1 [0061.620] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.620] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.620] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x60, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.620] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.620] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.620] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.620] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x68, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.620] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.620] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5e0, lpOverlapped=0x0) returned 1 [0061.620] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.620] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.620] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x68, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.620] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.620] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.620] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.621] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x70, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.621] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.621] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5d8, lpOverlapped=0x0) returned 1 [0061.621] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.621] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.621] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x70, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.621] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.621] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.621] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.621] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x78, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.621] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.621] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5d0, lpOverlapped=0x0) returned 1 [0061.621] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.621] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.621] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x78, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.622] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.622] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.622] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.622] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x80, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.622] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.622] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5c8, lpOverlapped=0x0) returned 1 [0061.622] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.622] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.622] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x80, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.622] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.622] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.622] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.622] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x88, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.622] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.622] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5c0, lpOverlapped=0x0) returned 1 [0061.623] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.623] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.623] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x88, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.623] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.623] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.623] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.623] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x90, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.623] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.623] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5b8, lpOverlapped=0x0) returned 1 [0061.623] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.623] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.623] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x90, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.623] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.623] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.623] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.624] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x98, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.624] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.624] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5b0, lpOverlapped=0x0) returned 1 [0061.624] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.624] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.624] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x98, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.624] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.624] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.624] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.624] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.624] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.624] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5a8, lpOverlapped=0x0) returned 1 [0061.625] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.625] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.625] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.625] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.625] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.625] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.625] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.625] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.625] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5a0, lpOverlapped=0x0) returned 1 [0061.625] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.625] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.625] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.625] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.625] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.625] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.626] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.626] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.626] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x598, lpOverlapped=0x0) returned 1 [0061.626] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.626] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.626] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.626] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.626] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.626] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.626] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.626] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.626] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x590, lpOverlapped=0x0) returned 1 [0061.626] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.626] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.626] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.627] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.627] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.627] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.627] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.627] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.627] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x588, lpOverlapped=0x0) returned 1 [0061.627] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.627] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.627] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.627] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.627] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.627] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.627] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.627] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.628] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x580, lpOverlapped=0x0) returned 1 [0061.628] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.628] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.628] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.628] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.628] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.628] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.628] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.628] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.628] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x578, lpOverlapped=0x0) returned 1 [0061.628] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.628] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.628] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.628] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.628] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.628] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.629] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.629] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.629] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x570, lpOverlapped=0x0) returned 1 [0061.629] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.629] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.629] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.629] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.629] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.629] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.629] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.629] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.629] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x568, lpOverlapped=0x0) returned 1 [0061.629] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.629] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.629] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.630] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.630] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.630] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.630] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.630] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.630] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x560, lpOverlapped=0x0) returned 1 [0061.630] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.630] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.630] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.630] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.630] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.630] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.630] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xf0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.630] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.631] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x558, lpOverlapped=0x0) returned 1 [0061.631] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.631] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.631] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xf0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.631] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x550, lpOverlapped=0x0) returned 1 [0061.631] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x548, lpOverlapped=0x0) returned 1 [0061.631] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x540, lpOverlapped=0x0) returned 1 [0061.631] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x538, lpOverlapped=0x0) returned 1 [0061.631] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x530, lpOverlapped=0x0) returned 1 [0061.631] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x528, lpOverlapped=0x0) returned 1 [0061.631] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x520, lpOverlapped=0x0) returned 1 [0061.631] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x518, lpOverlapped=0x0) returned 1 [0061.631] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x510, lpOverlapped=0x0) returned 1 [0061.631] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x508, lpOverlapped=0x0) returned 1 [0061.631] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x500, lpOverlapped=0x0) returned 1 [0061.632] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4f8, lpOverlapped=0x0) returned 1 [0061.632] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4f0, lpOverlapped=0x0) returned 1 [0061.632] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4e8, lpOverlapped=0x0) returned 1 [0061.632] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4e0, lpOverlapped=0x0) returned 1 [0061.632] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4d8, lpOverlapped=0x0) returned 1 [0061.632] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4d0, lpOverlapped=0x0) returned 1 [0061.632] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4c8, lpOverlapped=0x0) returned 1 [0061.632] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4c0, lpOverlapped=0x0) returned 1 [0061.632] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4b8, lpOverlapped=0x0) returned 1 [0061.632] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4b0, lpOverlapped=0x0) returned 1 [0061.632] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4a8, lpOverlapped=0x0) returned 1 [0061.632] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4a0, lpOverlapped=0x0) returned 1 [0061.632] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x498, lpOverlapped=0x0) returned 1 [0061.632] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x490, lpOverlapped=0x0) returned 1 [0061.633] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x488, lpOverlapped=0x0) returned 1 [0061.633] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x480, lpOverlapped=0x0) returned 1 [0061.633] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x478, lpOverlapped=0x0) returned 1 [0061.633] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x470, lpOverlapped=0x0) returned 1 [0061.633] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x468, lpOverlapped=0x0) returned 1 [0061.633] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x460, lpOverlapped=0x0) returned 1 [0061.633] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x458, lpOverlapped=0x0) returned 1 [0061.633] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x450, lpOverlapped=0x0) returned 1 [0061.633] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x448, lpOverlapped=0x0) returned 1 [0061.633] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x440, lpOverlapped=0x0) returned 1 [0061.633] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x438, lpOverlapped=0x0) returned 1 [0061.633] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x430, lpOverlapped=0x0) returned 1 [0061.633] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x428, lpOverlapped=0x0) returned 1 [0061.633] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x420, lpOverlapped=0x0) returned 1 [0061.633] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x418, lpOverlapped=0x0) returned 1 [0061.634] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x410, lpOverlapped=0x0) returned 1 [0061.634] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x408, lpOverlapped=0x0) returned 1 [0061.634] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x400, lpOverlapped=0x0) returned 1 [0061.634] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3f8, lpOverlapped=0x0) returned 1 [0061.634] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3f0, lpOverlapped=0x0) returned 1 [0061.634] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3e8, lpOverlapped=0x0) returned 1 [0061.634] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3e0, lpOverlapped=0x0) returned 1 [0061.634] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3d8, lpOverlapped=0x0) returned 1 [0061.634] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3d0, lpOverlapped=0x0) returned 1 [0061.634] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3c8, lpOverlapped=0x0) returned 1 [0061.634] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3c0, lpOverlapped=0x0) returned 1 [0061.634] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3b8, lpOverlapped=0x0) returned 1 [0061.634] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3b0, lpOverlapped=0x0) returned 1 [0061.634] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3a8, lpOverlapped=0x0) returned 1 [0061.635] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x3a0, lpOverlapped=0x0) returned 1 [0061.635] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x398, lpOverlapped=0x0) returned 1 [0061.635] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x390, lpOverlapped=0x0) returned 1 [0061.635] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x388, lpOverlapped=0x0) returned 1 [0061.635] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x380, lpOverlapped=0x0) returned 1 [0061.635] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x378, lpOverlapped=0x0) returned 1 [0061.635] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x370, lpOverlapped=0x0) returned 1 [0061.635] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x368, lpOverlapped=0x0) returned 1 [0061.635] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x360, lpOverlapped=0x0) returned 1 [0061.635] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x358, lpOverlapped=0x0) returned 1 [0061.635] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x350, lpOverlapped=0x0) returned 1 [0061.635] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x348, lpOverlapped=0x0) returned 1 [0061.635] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x340, lpOverlapped=0x0) returned 1 [0061.635] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x338, lpOverlapped=0x0) returned 1 [0061.636] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x330, lpOverlapped=0x0) returned 1 [0061.636] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x328, lpOverlapped=0x0) returned 1 [0061.636] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x320, lpOverlapped=0x0) returned 1 [0061.636] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x318, lpOverlapped=0x0) returned 1 [0061.636] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x310, lpOverlapped=0x0) returned 1 [0061.636] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x308, lpOverlapped=0x0) returned 1 [0061.636] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x300, lpOverlapped=0x0) returned 1 [0061.636] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2f8, lpOverlapped=0x0) returned 1 [0061.636] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2f0, lpOverlapped=0x0) returned 1 [0061.636] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2e8, lpOverlapped=0x0) returned 1 [0061.636] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2e0, lpOverlapped=0x0) returned 1 [0061.636] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2d8, lpOverlapped=0x0) returned 1 [0061.636] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2d0, lpOverlapped=0x0) returned 1 [0061.636] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2c8, lpOverlapped=0x0) returned 1 [0061.636] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2c0, lpOverlapped=0x0) returned 1 [0061.637] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2b8, lpOverlapped=0x0) returned 1 [0061.637] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2b0, lpOverlapped=0x0) returned 1 [0061.637] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2a8, lpOverlapped=0x0) returned 1 [0061.637] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x2a0, lpOverlapped=0x0) returned 1 [0061.637] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x298, lpOverlapped=0x0) returned 1 [0061.637] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x290, lpOverlapped=0x0) returned 1 [0061.637] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x288, lpOverlapped=0x0) returned 1 [0061.637] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x280, lpOverlapped=0x0) returned 1 [0061.637] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x278, lpOverlapped=0x0) returned 1 [0061.637] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x270, lpOverlapped=0x0) returned 1 [0061.637] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x268, lpOverlapped=0x0) returned 1 [0061.637] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x260, lpOverlapped=0x0) returned 1 [0061.637] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x258, lpOverlapped=0x0) returned 1 [0061.637] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x250, lpOverlapped=0x0) returned 1 [0061.637] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x248, lpOverlapped=0x0) returned 1 [0061.638] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x240, lpOverlapped=0x0) returned 1 [0061.638] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x238, lpOverlapped=0x0) returned 1 [0061.638] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x230, lpOverlapped=0x0) returned 1 [0061.638] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x228, lpOverlapped=0x0) returned 1 [0061.638] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x220, lpOverlapped=0x0) returned 1 [0061.638] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x218, lpOverlapped=0x0) returned 1 [0061.638] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x210, lpOverlapped=0x0) returned 1 [0061.638] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x208, lpOverlapped=0x0) returned 1 [0061.638] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x200, lpOverlapped=0x0) returned 1 [0061.638] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1f8, lpOverlapped=0x0) returned 1 [0061.638] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1f0, lpOverlapped=0x0) returned 1 [0061.638] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1e8, lpOverlapped=0x0) returned 1 [0061.638] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1e0, lpOverlapped=0x0) returned 1 [0061.638] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1d8, lpOverlapped=0x0) returned 1 [0061.639] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1d0, lpOverlapped=0x0) returned 1 [0061.639] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1c8, lpOverlapped=0x0) returned 1 [0061.639] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1c0, lpOverlapped=0x0) returned 1 [0061.639] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1b8, lpOverlapped=0x0) returned 1 [0061.639] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1b0, lpOverlapped=0x0) returned 1 [0061.639] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1a8, lpOverlapped=0x0) returned 1 [0061.639] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x1a0, lpOverlapped=0x0) returned 1 [0061.639] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x198, lpOverlapped=0x0) returned 1 [0061.639] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x190, lpOverlapped=0x0) returned 1 [0061.639] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x188, lpOverlapped=0x0) returned 1 [0061.639] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x180, lpOverlapped=0x0) returned 1 [0061.639] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x178, lpOverlapped=0x0) returned 1 [0061.639] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x170, lpOverlapped=0x0) returned 1 [0061.639] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x168, lpOverlapped=0x0) returned 1 [0061.640] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x160, lpOverlapped=0x0) returned 1 [0061.640] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x158, lpOverlapped=0x0) returned 1 [0061.640] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x150, lpOverlapped=0x0) returned 1 [0061.640] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x148, lpOverlapped=0x0) returned 1 [0061.640] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x140, lpOverlapped=0x0) returned 1 [0061.640] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x138, lpOverlapped=0x0) returned 1 [0061.640] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x130, lpOverlapped=0x0) returned 1 [0061.640] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x128, lpOverlapped=0x0) returned 1 [0061.640] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x120, lpOverlapped=0x0) returned 1 [0061.640] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x118, lpOverlapped=0x0) returned 1 [0061.640] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x110, lpOverlapped=0x0) returned 1 [0061.640] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x108, lpOverlapped=0x0) returned 1 [0061.640] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x100, lpOverlapped=0x0) returned 1 [0061.640] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xf8, lpOverlapped=0x0) returned 1 [0061.641] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xf0, lpOverlapped=0x0) returned 1 [0061.641] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xe8, lpOverlapped=0x0) returned 1 [0061.641] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xe0, lpOverlapped=0x0) returned 1 [0061.641] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xd8, lpOverlapped=0x0) returned 1 [0061.641] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xd0, lpOverlapped=0x0) returned 1 [0061.641] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xc8, lpOverlapped=0x0) returned 1 [0061.641] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xc0, lpOverlapped=0x0) returned 1 [0061.641] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xb8, lpOverlapped=0x0) returned 1 [0061.641] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xb0, lpOverlapped=0x0) returned 1 [0061.641] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa8, lpOverlapped=0x0) returned 1 [0061.641] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa0, lpOverlapped=0x0) returned 1 [0061.641] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x98, lpOverlapped=0x0) returned 1 [0061.641] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x90, lpOverlapped=0x0) returned 1 [0061.641] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x88, lpOverlapped=0x0) returned 1 [0061.642] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x80, lpOverlapped=0x0) returned 1 [0061.642] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x78, lpOverlapped=0x0) returned 1 [0061.642] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x70, lpOverlapped=0x0) returned 1 [0061.642] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x68, lpOverlapped=0x0) returned 1 [0061.642] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x60, lpOverlapped=0x0) returned 1 [0061.642] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x58, lpOverlapped=0x0) returned 1 [0061.642] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x50, lpOverlapped=0x0) returned 1 [0061.642] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x48, lpOverlapped=0x0) returned 1 [0061.642] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x40, lpOverlapped=0x0) returned 1 [0061.642] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x38, lpOverlapped=0x0) returned 1 [0061.642] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x30, lpOverlapped=0x0) returned 1 [0061.642] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x28, lpOverlapped=0x0) returned 1 [0061.642] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x20, lpOverlapped=0x0) returned 1 [0061.642] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x18, lpOverlapped=0x0) returned 1 [0061.642] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x10, lpOverlapped=0x0) returned 1 [0061.643] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8, lpOverlapped=0x0) returned 1 [0061.643] AreFileApisANSI () returned 1 [0061.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0061.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0061.643] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x13a) returned 0x6288b0 [0061.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6288b0, cchWideChar=74 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 74 [0061.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x628944, cchWideChar=83 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.isolated") returned 83 [0061.643] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.isolated"), dwFlags=0x2) returned 1 [0061.643] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288b0 | out: hHeap=0x610000) returned 1 [0061.643] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.643] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.643] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ea0 | out: hHeap=0x610000) returned 1 [0061.643] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.644] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0061.644] FindClose (in: hFindFile=0x628770 | out: hFindFile=0x628770) returned 1 [0061.644] FindNextFileA (in: hFindFile=0x6287b0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0061.644] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x6287f0 [0061.644] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628838 [0061.644] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628880 [0061.644] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628838 | out: hHeap=0x610000) returned 1 [0061.644] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628880 | out: hHeap=0x610000) returned 1 [0061.644] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.644] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x6287f0 [0061.644] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628838 [0061.644] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628d90 [0061.644] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x77) returned 0x62d570 [0061.644] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d90 | out: hHeap=0x610000) returned 1 [0061.644] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.644] AreFileApisANSI () returned 1 [0061.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.644] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa2) returned 0x628d90 [0061.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x628d90, cchWideChar=81 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\@@_README_@@.txt") returned 81 [0061.644] CreateFileW (lpFileName="C:\\\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\@@_README_@@.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\@@_readme_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d564, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54 [0061.646] GetFileType (hFile=0x54) returned 0x1 [0061.647] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d90 | out: hHeap=0x610000) returned 1 [0061.647] AreFileApisANSI () returned 1 [0061.647] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0061.647] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa8) returned 0x628d90 [0061.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x628d90, cchWideChar=84 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\@@_ATTENTION_@@.txt") returned 84 [0061.648] CreateFileW (lpFileName="C:\\\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\@@_ATTENTION_@@.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\@@_attention_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d564, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54 [0061.648] GetFileType (hFile=0x54) returned 0x1 [0061.648] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d90 | out: hHeap=0x610000) returned 1 [0061.649] AreFileApisANSI () returned 1 [0061.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.649] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa2) returned 0x628d90 [0061.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x628d90, cchWideChar=81 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\@@_HELPER_@@.txt") returned 81 [0061.649] CreateFileW (lpFileName="C:\\\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\@@_HELPER_@@.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\@@_helper_@@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18d564, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54 [0061.650] GetFileType (hFile=0x54) returned 0x1 [0061.650] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d90 | out: hHeap=0x610000) returned 1 [0061.650] FindFirstFileA (in: lpFileName="C:\\\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe328ada0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe328ada0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a00053f, dwReserved1=0xcc, cFileName=".", cAlternateFileName="")) returned 0x628770 [0061.651] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe328ada0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe328ada0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a00053f, dwReserved1=0xcc, cFileName="..", cAlternateFileName="")) returned 1 [0061.651] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe328ada0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe328ada0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe328ada0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x3a00053f, dwReserved1=0xcc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.651] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.651] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.651] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.651] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.651] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.651] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.651] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe328ada0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe328ada0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe328ada0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.651] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.651] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.651] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.651] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.651] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.651] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.651] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe328ada0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe328ada0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe328ada0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.651] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.651] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.651] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.651] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.651] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.651] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.651] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0061.651] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.651] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.651] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.651] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.651] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0061.651] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.651] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.651] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.651] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.651] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0061.652] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.652] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.652] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.652] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.652] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.652] AreFileApisANSI () returned 1 [0061.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 79 [0061.652] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x9e) returned 0x6287f0 [0061.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6287f0, cchWideChar=79 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 79 [0061.652] CreateFileW (lpFileName="C:\\\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x18d518, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x58 [0061.652] GetFileType (hFile=0x58) returned 0x1 [0061.652] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.652] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d564 | out: lpNewFilePointer=0x0) returned 1 [0061.652] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d518 | out: lpNewFilePointer=0x0) returned 1 [0061.652] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d54c | out: lpNewFilePointer=0x0) returned 1 [0061.652] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.652] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.652] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d54c | out: lpNewFilePointer=0x0) returned 1 [0061.653] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.653] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.653] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xc72, lpOverlapped=0x0) returned 1 [0061.654] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.654] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.654] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.654] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.654] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.654] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.655] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xc6a, lpOverlapped=0x0) returned 1 [0061.655] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.655] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.655] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.655] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.655] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.655] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.655] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.655] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.655] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xc62, lpOverlapped=0x0) returned 1 [0061.655] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.655] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.655] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.656] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.656] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.656] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.656] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x18, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.656] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.656] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xc5a, lpOverlapped=0x0) returned 1 [0061.656] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.656] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.656] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x18, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.656] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.656] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.656] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.656] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x20, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.656] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.656] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xc52, lpOverlapped=0x0) returned 1 [0061.656] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.657] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.657] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x20, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.657] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.657] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.657] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.657] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x28, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.657] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.657] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xc4a, lpOverlapped=0x0) returned 1 [0061.657] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.657] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.657] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x28, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.657] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.657] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.657] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.657] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x30, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.658] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.658] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xc42, lpOverlapped=0x0) returned 1 [0061.658] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.658] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.658] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x30, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.658] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.658] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.658] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.658] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x38, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.658] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.658] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xc3a, lpOverlapped=0x0) returned 1 [0061.658] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.658] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.658] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x38, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.658] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.659] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.659] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.659] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x40, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.659] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.659] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xc32, lpOverlapped=0x0) returned 1 [0061.659] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.659] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.659] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x40, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.659] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.659] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.659] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.659] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x48, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.659] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.659] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xc2a, lpOverlapped=0x0) returned 1 [0061.659] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.660] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.660] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x48, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.660] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.660] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.660] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.660] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x50, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.660] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.660] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xc22, lpOverlapped=0x0) returned 1 [0061.660] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.660] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.660] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x50, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.660] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.660] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.660] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.660] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x58, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.661] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.661] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xc1a, lpOverlapped=0x0) returned 1 [0061.661] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.661] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.661] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x58, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.661] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.661] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.661] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.661] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x60, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.661] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.661] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xc12, lpOverlapped=0x0) returned 1 [0061.661] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.661] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.661] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x60, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.661] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.662] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.662] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.662] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x68, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.662] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.662] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xc0a, lpOverlapped=0x0) returned 1 [0061.662] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.662] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.662] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x68, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.662] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.662] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.662] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.662] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x70, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.662] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.662] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xc02, lpOverlapped=0x0) returned 1 [0061.662] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.663] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.663] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x70, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.663] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.663] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.663] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.663] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x78, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.663] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.663] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xbfa, lpOverlapped=0x0) returned 1 [0061.663] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.663] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.663] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x78, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.663] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.663] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.663] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.664] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x80, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.664] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.664] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xbf2, lpOverlapped=0x0) returned 1 [0061.664] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.664] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.664] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x80, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.664] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.664] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.664] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.664] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x88, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.664] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.664] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xbea, lpOverlapped=0x0) returned 1 [0061.664] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.664] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.664] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x88, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.664] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.665] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.665] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.665] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x90, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.665] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.665] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xbe2, lpOverlapped=0x0) returned 1 [0061.665] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.665] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.665] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x90, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.665] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.665] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.665] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.665] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x98, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.665] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.665] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xbda, lpOverlapped=0x0) returned 1 [0061.665] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.666] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.666] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x98, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.666] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.666] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.666] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.666] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.666] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.666] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xbd2, lpOverlapped=0x0) returned 1 [0061.666] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.666] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.666] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.666] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.666] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.666] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.666] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.667] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.667] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xbca, lpOverlapped=0x0) returned 1 [0061.667] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.667] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.667] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xa8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.667] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.667] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.667] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.667] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.667] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.667] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xbc2, lpOverlapped=0x0) returned 1 [0061.667] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.667] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.667] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.667] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.668] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.668] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.668] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.668] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.668] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xbba, lpOverlapped=0x0) returned 1 [0061.668] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.668] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.668] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xb8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.668] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.668] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.668] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.668] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.668] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.668] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xbb2, lpOverlapped=0x0) returned 1 [0061.668] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.669] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.669] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.669] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.669] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.669] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.669] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.669] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.669] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xbaa, lpOverlapped=0x0) returned 1 [0061.669] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.669] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.669] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xc8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.669] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.669] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.669] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.669] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.670] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.670] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xba2, lpOverlapped=0x0) returned 1 [0061.670] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.670] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.670] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.670] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.670] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.670] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.670] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.670] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.670] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xb9a, lpOverlapped=0x0) returned 1 [0061.670] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.670] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.670] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xd8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.670] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.671] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.671] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.671] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.671] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.671] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xb92, lpOverlapped=0x0) returned 1 [0061.671] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.671] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.671] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.671] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.671] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.671] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.671] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe8, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.671] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.671] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xb8a, lpOverlapped=0x0) returned 1 [0061.672] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.672] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.672] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xe8, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.672] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d56c | out: lpNewFilePointer=0x0) returned 1 [0061.672] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d534 | out: lpNewFilePointer=0x0) returned 1 [0061.672] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4c8 | out: lpNewFilePointer=0x0) returned 1 [0061.672] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xf0, lpNewFilePointer=0x0, dwMoveMethod=0x18d544 | out: lpNewFilePointer=0x0) returned 1 [0061.672] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d4f8 | out: lpNewFilePointer=0x0) returned 1 [0061.672] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xb82, lpOverlapped=0x0) returned 1 [0061.672] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5a8 | out: lpNewFilePointer=0x0) returned 1 [0061.672] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d53c | out: lpNewFilePointer=0x0) returned 1 [0061.672] SetFilePointerEx (in: hFile=0x58, liDistanceToMove=0xf0, lpNewFilePointer=0x0, dwMoveMethod=0x18d5b8 | out: lpNewFilePointer=0x0) returned 1 [0061.672] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xb7a, lpOverlapped=0x0) returned 1 [0061.672] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xb72, lpOverlapped=0x0) returned 1 [0061.672] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xb6a, lpOverlapped=0x0) returned 1 [0061.673] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xb62, lpOverlapped=0x0) returned 1 [0061.673] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xb5a, lpOverlapped=0x0) returned 1 [0061.673] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xb52, lpOverlapped=0x0) returned 1 [0061.673] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xb4a, lpOverlapped=0x0) returned 1 [0061.673] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xb42, lpOverlapped=0x0) returned 1 [0061.673] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xb3a, lpOverlapped=0x0) returned 1 [0061.673] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xb32, lpOverlapped=0x0) returned 1 [0061.673] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xb2a, lpOverlapped=0x0) returned 1 [0061.673] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xb22, lpOverlapped=0x0) returned 1 [0061.673] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xb1a, lpOverlapped=0x0) returned 1 [0061.673] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xb12, lpOverlapped=0x0) returned 1 [0061.673] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xb0a, lpOverlapped=0x0) returned 1 [0061.673] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xb02, lpOverlapped=0x0) returned 1 [0061.673] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xafa, lpOverlapped=0x0) returned 1 [0061.673] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xaf2, lpOverlapped=0x0) returned 1 [0061.674] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xaea, lpOverlapped=0x0) returned 1 [0061.674] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xae2, lpOverlapped=0x0) returned 1 [0061.674] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xada, lpOverlapped=0x0) returned 1 [0061.674] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xad2, lpOverlapped=0x0) returned 1 [0061.674] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xaca, lpOverlapped=0x0) returned 1 [0061.674] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xac2, lpOverlapped=0x0) returned 1 [0061.674] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xaba, lpOverlapped=0x0) returned 1 [0061.674] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xab2, lpOverlapped=0x0) returned 1 [0061.674] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xaaa, lpOverlapped=0x0) returned 1 [0061.674] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xaa2, lpOverlapped=0x0) returned 1 [0061.674] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa9a, lpOverlapped=0x0) returned 1 [0061.674] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa92, lpOverlapped=0x0) returned 1 [0061.674] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa8a, lpOverlapped=0x0) returned 1 [0061.674] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa82, lpOverlapped=0x0) returned 1 [0061.675] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa7a, lpOverlapped=0x0) returned 1 [0061.675] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa72, lpOverlapped=0x0) returned 1 [0061.675] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa6a, lpOverlapped=0x0) returned 1 [0061.675] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa62, lpOverlapped=0x0) returned 1 [0061.675] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa5a, lpOverlapped=0x0) returned 1 [0061.675] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa52, lpOverlapped=0x0) returned 1 [0061.675] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa4a, lpOverlapped=0x0) returned 1 [0061.675] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa42, lpOverlapped=0x0) returned 1 [0061.675] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa3a, lpOverlapped=0x0) returned 1 [0061.675] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa32, lpOverlapped=0x0) returned 1 [0061.675] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa2a, lpOverlapped=0x0) returned 1 [0061.675] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa22, lpOverlapped=0x0) returned 1 [0061.675] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa1a, lpOverlapped=0x0) returned 1 [0061.676] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa12, lpOverlapped=0x0) returned 1 [0061.676] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa0a, lpOverlapped=0x0) returned 1 [0061.676] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0xa02, lpOverlapped=0x0) returned 1 [0061.676] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x9fa, lpOverlapped=0x0) returned 1 [0061.676] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x9f2, lpOverlapped=0x0) returned 1 [0061.676] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x9ea, lpOverlapped=0x0) returned 1 [0061.676] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x9e2, lpOverlapped=0x0) returned 1 [0061.676] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x9da, lpOverlapped=0x0) returned 1 [0061.676] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x9d2, lpOverlapped=0x0) returned 1 [0061.676] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x9ca, lpOverlapped=0x0) returned 1 [0061.676] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x9c2, lpOverlapped=0x0) returned 1 [0061.676] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x9ba, lpOverlapped=0x0) returned 1 [0061.676] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x9b2, lpOverlapped=0x0) returned 1 [0061.676] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x9aa, lpOverlapped=0x0) returned 1 [0061.676] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x9a2, lpOverlapped=0x0) returned 1 [0061.677] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x99a, lpOverlapped=0x0) returned 1 [0061.677] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x992, lpOverlapped=0x0) returned 1 [0061.677] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x98a, lpOverlapped=0x0) returned 1 [0061.677] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x982, lpOverlapped=0x0) returned 1 [0061.677] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x97a, lpOverlapped=0x0) returned 1 [0061.677] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x972, lpOverlapped=0x0) returned 1 [0061.677] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x96a, lpOverlapped=0x0) returned 1 [0061.677] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x962, lpOverlapped=0x0) returned 1 [0061.677] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x95a, lpOverlapped=0x0) returned 1 [0061.677] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x952, lpOverlapped=0x0) returned 1 [0061.677] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x94a, lpOverlapped=0x0) returned 1 [0061.677] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x942, lpOverlapped=0x0) returned 1 [0061.677] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x93a, lpOverlapped=0x0) returned 1 [0061.677] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x932, lpOverlapped=0x0) returned 1 [0061.677] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x92a, lpOverlapped=0x0) returned 1 [0061.678] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x922, lpOverlapped=0x0) returned 1 [0061.678] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x91a, lpOverlapped=0x0) returned 1 [0061.678] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x912, lpOverlapped=0x0) returned 1 [0061.678] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x90a, lpOverlapped=0x0) returned 1 [0061.678] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x902, lpOverlapped=0x0) returned 1 [0061.678] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8fa, lpOverlapped=0x0) returned 1 [0061.678] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8f2, lpOverlapped=0x0) returned 1 [0061.678] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8ea, lpOverlapped=0x0) returned 1 [0061.678] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8e2, lpOverlapped=0x0) returned 1 [0061.678] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8da, lpOverlapped=0x0) returned 1 [0061.678] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8d2, lpOverlapped=0x0) returned 1 [0061.678] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8ca, lpOverlapped=0x0) returned 1 [0061.678] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8c2, lpOverlapped=0x0) returned 1 [0061.678] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8ba, lpOverlapped=0x0) returned 1 [0061.679] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8b2, lpOverlapped=0x0) returned 1 [0061.679] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8aa, lpOverlapped=0x0) returned 1 [0061.679] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x8a2, lpOverlapped=0x0) returned 1 [0061.679] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x89a, lpOverlapped=0x0) returned 1 [0061.679] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x892, lpOverlapped=0x0) returned 1 [0061.679] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x88a, lpOverlapped=0x0) returned 1 [0061.679] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x882, lpOverlapped=0x0) returned 1 [0061.679] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x87a, lpOverlapped=0x0) returned 1 [0061.679] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x872, lpOverlapped=0x0) returned 1 [0061.679] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x86a, lpOverlapped=0x0) returned 1 [0061.679] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x862, lpOverlapped=0x0) returned 1 [0061.679] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x85a, lpOverlapped=0x0) returned 1 [0061.679] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x852, lpOverlapped=0x0) returned 1 [0061.679] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x84a, lpOverlapped=0x0) returned 1 [0061.680] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x842, lpOverlapped=0x0) returned 1 [0061.680] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x83a, lpOverlapped=0x0) returned 1 [0061.680] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x832, lpOverlapped=0x0) returned 1 [0061.680] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x82a, lpOverlapped=0x0) returned 1 [0061.680] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x822, lpOverlapped=0x0) returned 1 [0061.680] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x81a, lpOverlapped=0x0) returned 1 [0061.680] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x812, lpOverlapped=0x0) returned 1 [0061.680] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x80a, lpOverlapped=0x0) returned 1 [0061.680] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x802, lpOverlapped=0x0) returned 1 [0061.680] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7fa, lpOverlapped=0x0) returned 1 [0061.680] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7f2, lpOverlapped=0x0) returned 1 [0061.680] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7ea, lpOverlapped=0x0) returned 1 [0061.680] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7e2, lpOverlapped=0x0) returned 1 [0061.680] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7da, lpOverlapped=0x0) returned 1 [0061.680] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7d2, lpOverlapped=0x0) returned 1 [0061.681] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7ca, lpOverlapped=0x0) returned 1 [0061.681] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7c2, lpOverlapped=0x0) returned 1 [0061.681] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7ba, lpOverlapped=0x0) returned 1 [0061.681] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7b2, lpOverlapped=0x0) returned 1 [0061.681] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7aa, lpOverlapped=0x0) returned 1 [0061.681] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x7a2, lpOverlapped=0x0) returned 1 [0061.681] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x79a, lpOverlapped=0x0) returned 1 [0061.681] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x792, lpOverlapped=0x0) returned 1 [0061.681] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x78a, lpOverlapped=0x0) returned 1 [0061.681] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x782, lpOverlapped=0x0) returned 1 [0061.681] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x77a, lpOverlapped=0x0) returned 1 [0061.681] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x772, lpOverlapped=0x0) returned 1 [0061.681] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x76a, lpOverlapped=0x0) returned 1 [0061.681] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x762, lpOverlapped=0x0) returned 1 [0061.681] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x75a, lpOverlapped=0x0) returned 1 [0061.682] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x752, lpOverlapped=0x0) returned 1 [0061.682] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x74a, lpOverlapped=0x0) returned 1 [0061.682] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x742, lpOverlapped=0x0) returned 1 [0061.682] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x73a, lpOverlapped=0x0) returned 1 [0061.682] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x732, lpOverlapped=0x0) returned 1 [0061.682] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x72a, lpOverlapped=0x0) returned 1 [0061.682] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x722, lpOverlapped=0x0) returned 1 [0061.682] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x71a, lpOverlapped=0x0) returned 1 [0061.682] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x712, lpOverlapped=0x0) returned 1 [0061.682] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x70a, lpOverlapped=0x0) returned 1 [0061.682] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x702, lpOverlapped=0x0) returned 1 [0061.682] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6fa, lpOverlapped=0x0) returned 1 [0061.682] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6f2, lpOverlapped=0x0) returned 1 [0061.682] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6ea, lpOverlapped=0x0) returned 1 [0061.683] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6e2, lpOverlapped=0x0) returned 1 [0061.683] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6da, lpOverlapped=0x0) returned 1 [0061.683] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6d2, lpOverlapped=0x0) returned 1 [0061.683] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6ca, lpOverlapped=0x0) returned 1 [0061.683] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6c2, lpOverlapped=0x0) returned 1 [0061.683] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6ba, lpOverlapped=0x0) returned 1 [0061.683] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6b2, lpOverlapped=0x0) returned 1 [0061.683] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6aa, lpOverlapped=0x0) returned 1 [0061.683] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x6a2, lpOverlapped=0x0) returned 1 [0061.683] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x69a, lpOverlapped=0x0) returned 1 [0061.683] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x692, lpOverlapped=0x0) returned 1 [0061.683] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x68a, lpOverlapped=0x0) returned 1 [0061.683] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x682, lpOverlapped=0x0) returned 1 [0061.683] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x67a, lpOverlapped=0x0) returned 1 [0061.684] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x672, lpOverlapped=0x0) returned 1 [0061.684] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x66a, lpOverlapped=0x0) returned 1 [0061.684] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x662, lpOverlapped=0x0) returned 1 [0061.684] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x65a, lpOverlapped=0x0) returned 1 [0061.684] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x652, lpOverlapped=0x0) returned 1 [0061.684] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x64a, lpOverlapped=0x0) returned 1 [0061.684] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x642, lpOverlapped=0x0) returned 1 [0061.684] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x63a, lpOverlapped=0x0) returned 1 [0061.684] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x632, lpOverlapped=0x0) returned 1 [0061.684] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x62a, lpOverlapped=0x0) returned 1 [0061.684] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x622, lpOverlapped=0x0) returned 1 [0061.684] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x61a, lpOverlapped=0x0) returned 1 [0061.684] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x612, lpOverlapped=0x0) returned 1 [0061.684] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x60a, lpOverlapped=0x0) returned 1 [0061.684] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x602, lpOverlapped=0x0) returned 1 [0061.685] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5fa, lpOverlapped=0x0) returned 1 [0061.685] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5f2, lpOverlapped=0x0) returned 1 [0061.685] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5ea, lpOverlapped=0x0) returned 1 [0061.685] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5e2, lpOverlapped=0x0) returned 1 [0061.685] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5da, lpOverlapped=0x0) returned 1 [0061.685] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5d2, lpOverlapped=0x0) returned 1 [0061.685] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5ca, lpOverlapped=0x0) returned 1 [0061.685] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5c2, lpOverlapped=0x0) returned 1 [0061.685] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5ba, lpOverlapped=0x0) returned 1 [0061.685] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5b2, lpOverlapped=0x0) returned 1 [0061.685] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5aa, lpOverlapped=0x0) returned 1 [0061.685] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x5a2, lpOverlapped=0x0) returned 1 [0061.685] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x59a, lpOverlapped=0x0) returned 1 [0061.685] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x592, lpOverlapped=0x0) returned 1 [0061.686] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x58a, lpOverlapped=0x0) returned 1 [0061.686] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x582, lpOverlapped=0x0) returned 1 [0061.686] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x57a, lpOverlapped=0x0) returned 1 [0061.686] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x572, lpOverlapped=0x0) returned 1 [0061.686] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x56a, lpOverlapped=0x0) returned 1 [0061.686] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x562, lpOverlapped=0x0) returned 1 [0061.686] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x55a, lpOverlapped=0x0) returned 1 [0061.686] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x552, lpOverlapped=0x0) returned 1 [0061.686] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x54a, lpOverlapped=0x0) returned 1 [0061.686] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x542, lpOverlapped=0x0) returned 1 [0061.686] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x53a, lpOverlapped=0x0) returned 1 [0061.686] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x532, lpOverlapped=0x0) returned 1 [0061.686] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x52a, lpOverlapped=0x0) returned 1 [0061.686] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x522, lpOverlapped=0x0) returned 1 [0061.687] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x51a, lpOverlapped=0x0) returned 1 [0061.687] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x512, lpOverlapped=0x0) returned 1 [0061.687] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x50a, lpOverlapped=0x0) returned 1 [0061.687] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x502, lpOverlapped=0x0) returned 1 [0061.687] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4fa, lpOverlapped=0x0) returned 1 [0061.687] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4f2, lpOverlapped=0x0) returned 1 [0061.687] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4ea, lpOverlapped=0x0) returned 1 [0061.687] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4e2, lpOverlapped=0x0) returned 1 [0061.687] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4da, lpOverlapped=0x0) returned 1 [0061.687] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4d2, lpOverlapped=0x0) returned 1 [0061.688] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4ca, lpOverlapped=0x0) returned 1 [0061.688] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4c2, lpOverlapped=0x0) returned 1 [0061.688] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4ba, lpOverlapped=0x0) returned 1 [0061.688] ReadFile (in: hFile=0x58, lpBuffer=0x62e578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d4dc, lpOverlapped=0x0 | out: lpBuffer=0x62e578*, lpNumberOfBytesRead=0x18d4dc*=0x4b2, lpOverlapped=0x0) returned 1 [0061.689] AreFileApisANSI () returned 1 [0061.689] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 79 [0061.689] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0061.689] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x14e) returned 0x6288b0 [0061.689] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6288b0, cchWideChar=79 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 79 [0061.689] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x62894e, cchWideChar=88 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.isolated") returned 88 [0061.689] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.isolated"), dwFlags=0x2) returned 1 [0061.690] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288b0 | out: hHeap=0x610000) returned 1 [0061.690] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.690] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.690] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ea0 | out: hHeap=0x610000) returned 1 [0061.690] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.690] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0061.690] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.690] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.690] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.690] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.690] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.690] AreFileApisANSI () returned 1 [0061.690] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0061.690] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x94) returned 0x6287f0 [0061.690] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6287f0, cchWideChar=74 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 74 [0061.697] AreFileApisANSI () returned 1 [0061.697] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0061.698] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0061.698] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x13a) returned 0x6288b0 [0061.698] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6288b0, cchWideChar=74 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 74 [0061.698] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x628944, cchWideChar=83 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.isolated") returned 83 [0061.698] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.isolated"), dwFlags=0x2) returned 1 [0061.698] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288b0 | out: hHeap=0x610000) returned 1 [0061.698] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.698] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.698] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ea0 | out: hHeap=0x610000) returned 1 [0061.698] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.698] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0061.698] FindClose (in: hFindFile=0x628770 | out: hFindFile=0x628770) returned 1 [0061.698] FindNextFileA (in: hFindFile=0x6287b0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0061.698] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x6287f0 [0061.698] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628838 [0061.698] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628880 [0061.698] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628838 | out: hHeap=0x610000) returned 1 [0061.699] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628880 | out: hHeap=0x610000) returned 1 [0061.699] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.699] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x6287f0 [0061.699] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628838 [0061.699] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628d90 [0061.699] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x77) returned 0x62d570 [0061.699] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d90 | out: hHeap=0x610000) returned 1 [0061.699] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.699] AreFileApisANSI () returned 1 [0061.699] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.699] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa2) returned 0x628d90 [0061.699] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x628d90, cchWideChar=81 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\@@_README_@@.txt") returned 81 [0061.702] GetFileType (hFile=0x54) returned 0x1 [0061.702] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d90 | out: hHeap=0x610000) returned 1 [0061.703] AreFileApisANSI () returned 1 [0061.703] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0061.703] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa8) returned 0x628d90 [0061.703] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x628d90, cchWideChar=84 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\@@_ATTENTION_@@.txt") returned 84 [0061.706] AreFileApisANSI () returned 1 [0061.706] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.706] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa2) returned 0x628d90 [0061.706] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x628d90, cchWideChar=81 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\@@_HELPER_@@.txt") returned 81 [0061.708] FindFirstFileA (in: lpFileName="C:\\\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe3323320, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3323320, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a00053f, dwReserved1=0xcc, cFileName=".", cAlternateFileName="")) returned 0x628770 [0061.708] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe3323320, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3323320, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a00053f, dwReserved1=0xcc, cFileName="..", cAlternateFileName="")) returned 1 [0061.708] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3323320, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3323320, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3323320, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x3a00053f, dwReserved1=0xcc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.708] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.708] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.708] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.708] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.708] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.708] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.708] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3323320, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3323320, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3323320, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.708] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.708] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.708] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.708] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.708] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.708] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.708] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe32fd1c0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe32fd1c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3323320, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.708] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.708] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.708] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.708] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.708] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.708] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.708] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0061.708] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.708] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.708] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.709] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.709] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.709] AreFileApisANSI () returned 1 [0061.709] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0061.709] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x94) returned 0x6287f0 [0061.709] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6287f0, cchWideChar=74 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 74 [0061.712] AreFileApisANSI () returned 1 [0061.713] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0061.713] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0061.713] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x13a) returned 0x6288b0 [0061.713] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6288b0, cchWideChar=74 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 74 [0061.713] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x628944, cchWideChar=83 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.isolated") returned 83 [0061.713] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.isolated"), dwFlags=0x2) returned 1 [0061.713] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288b0 | out: hHeap=0x610000) returned 1 [0061.713] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.713] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.713] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ea0 | out: hHeap=0x610000) returned 1 [0061.713] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.713] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0061.713] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.713] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.713] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.713] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.713] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0061.713] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.713] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.713] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.713] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.713] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0061.713] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.714] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.714] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.714] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.714] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.714] AreFileApisANSI () returned 1 [0061.714] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 76 [0061.714] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x98) returned 0x6287f0 [0061.714] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6287f0, cchWideChar=76 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 76 [0061.717] AreFileApisANSI () returned 1 [0061.717] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 76 [0061.717] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 85 [0061.717] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x142) returned 0x6288b0 [0061.717] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6288b0, cchWideChar=76 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 76 [0061.717] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x628948, cchWideChar=85 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.isolated") returned 85 [0061.717] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.isolated"), dwFlags=0x2) returned 1 [0061.717] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288b0 | out: hHeap=0x610000) returned 1 [0061.717] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.717] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.718] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ea0 | out: hHeap=0x610000) returned 1 [0061.718] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.718] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0061.718] FindClose (in: hFindFile=0x628770 | out: hFindFile=0x628770) returned 1 [0061.718] FindNextFileA (in: hFindFile=0x6287b0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0061.718] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x6287f0 [0061.718] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628838 [0061.718] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628880 [0061.718] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628838 | out: hHeap=0x610000) returned 1 [0061.718] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628880 | out: hHeap=0x610000) returned 1 [0061.718] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.718] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x6287f0 [0061.718] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628838 [0061.718] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628d90 [0061.718] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x77) returned 0x62d570 [0061.718] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d90 | out: hHeap=0x610000) returned 1 [0061.718] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.718] AreFileApisANSI () returned 1 [0061.718] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.718] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa2) returned 0x628d90 [0061.718] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x628d90, cchWideChar=81 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\@@_README_@@.txt") returned 81 [0061.729] AreFileApisANSI () returned 1 [0061.729] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0061.729] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa8) returned 0x628d90 [0061.729] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x628d90, cchWideChar=84 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\@@_ATTENTION_@@.txt") returned 84 [0061.730] AreFileApisANSI () returned 1 [0061.730] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.730] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa2) returned 0x628d90 [0061.730] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x628d90, cchWideChar=81 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\@@_HELPER_@@.txt") returned 81 [0061.732] FindFirstFileA (in: lpFileName="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe3349480, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3349480, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a00053f, dwReserved1=0xcc, cFileName=".", cAlternateFileName="")) returned 0x628770 [0061.732] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe3349480, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3349480, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a00053f, dwReserved1=0xcc, cFileName="..", cAlternateFileName="")) returned 1 [0061.732] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3349480, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3349480, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3349480, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x3a00053f, dwReserved1=0xcc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.732] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.732] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.732] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.732] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.732] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.732] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.732] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3349480, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3349480, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3349480, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.732] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.732] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.732] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.732] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.732] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.732] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.732] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3349480, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3349480, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3349480, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.733] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.733] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.733] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.733] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624768 [0061.733] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624768 | out: hHeap=0x610000) returned 1 [0061.733] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.733] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0061.733] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.733] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.733] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.733] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.733] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.733] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628848 [0061.733] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628da0 [0061.733] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x77) returned 0x62e578 [0061.733] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628da0 | out: hHeap=0x610000) returned 1 [0061.733] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.733] AreFileApisANSI () returned 1 [0061.733] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62e578, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 90 [0061.733] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xb4) returned 0x62e5f8 [0061.733] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62e578, cbMultiByte=-1, lpWideCharStr=0x62e5f8, cchWideChar=90 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\@@_README_@@.txt") returned 90 [0061.733] GetFileType (hFile=0x58) returned 0x1 [0061.733] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62e5f8 | out: hHeap=0x610000) returned 1 [0061.734] AreFileApisANSI () returned 1 [0061.734] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62e578, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 93 [0061.734] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xba) returned 0x62e5f8 [0061.734] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62e578, cbMultiByte=-1, lpWideCharStr=0x62e5f8, cchWideChar=93 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\@@_ATTENTION_@@.txt") returned 93 [0061.737] AreFileApisANSI () returned 1 [0061.737] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62e578, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 90 [0061.737] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xb4) returned 0x62e5f8 [0061.737] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62e578, cbMultiByte=-1, lpWideCharStr=0x62e5f8, cchWideChar=90 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\@@_HELPER_@@.txt") returned 90 [0061.738] FindFirstFileA (in: lpFileName="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe336f5e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe336f5e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3d00033e, dwReserved1=0xcc, cFileName=".", cAlternateFileName="")) returned 0x628890 [0061.738] FindNextFileA (in: hFindFile=0x628890, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe336f5e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe336f5e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3d00033e, dwReserved1=0xcc, cFileName="..", cAlternateFileName="")) returned 1 [0061.738] FindNextFileA (in: hFindFile=0x628890, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe336f5e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe336f5e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe336f5e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x3d00033e, dwReserved1=0xcc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.738] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.738] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6288d0 [0061.738] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288d0 | out: hHeap=0x610000) returned 1 [0061.738] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624790 [0061.738] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624790 | out: hHeap=0x610000) returned 1 [0061.738] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.738] FindNextFileA (in: hFindFile=0x628890, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe336f5e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe336f5e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe336f5e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6288c8, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.739] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.739] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6288d0 [0061.739] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288d0 | out: hHeap=0x610000) returned 1 [0061.739] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624790 [0061.739] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624790 | out: hHeap=0x610000) returned 1 [0061.739] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.739] FindNextFileA (in: hFindFile=0x628890, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3349480, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3349480, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe336f5e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6288c8, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.739] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.739] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6288d0 [0061.739] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288d0 | out: hHeap=0x610000) returned 1 [0061.739] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624790 [0061.739] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624790 | out: hHeap=0x610000) returned 1 [0061.739] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.739] FindNextFileA (in: hFindFile=0x628890, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x610000, dwReserved1=0x6288c8, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0061.739] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.739] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6288d0 [0061.739] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288d0 | out: hHeap=0x610000) returned 1 [0061.739] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.739] FindNextFileA (in: hFindFile=0x628890, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x610000, dwReserved1=0x6288c8, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0061.739] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.739] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6288d0 [0061.739] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288d0 | out: hHeap=0x610000) returned 1 [0061.739] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.739] FindNextFileA (in: hFindFile=0x628890, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x610000, dwReserved1=0x6288c8, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0061.739] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.739] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6288d0 [0061.739] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288d0 | out: hHeap=0x610000) returned 1 [0061.739] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.739] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.739] AreFileApisANSI () returned 1 [0061.739] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0061.739] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa6) returned 0x6288d0 [0061.739] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x6288d0, cchWideChar=83 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 83 [0061.743] AreFileApisANSI () returned 1 [0061.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0061.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6288d0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 92 [0061.743] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x15e) returned 0x628938 [0061.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x628938, cchWideChar=83 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 83 [0061.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6288d0, cbMultiByte=-1, lpWideCharStr=0x6289de, cchWideChar=92 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.isolated") returned 92 [0061.743] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.isolated"), dwFlags=0x2) returned 1 [0061.744] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628938 | out: hHeap=0x610000) returned 1 [0061.744] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288d0 | out: hHeap=0x610000) returned 1 [0061.744] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.744] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ea0 | out: hHeap=0x610000) returned 1 [0061.744] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.744] FindNextFileA (in: hFindFile=0x628890, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x610000, dwReserved1=0x6288c8, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0061.744] FindClose (in: hFindFile=0x628890 | out: hFindFile=0x628890) returned 1 [0061.744] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0061.744] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.744] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.744] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.744] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.744] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.744] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628848 [0061.744] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628da0 [0061.744] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x77) returned 0x62e578 [0061.744] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628da0 | out: hHeap=0x610000) returned 1 [0061.744] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.744] AreFileApisANSI () returned 1 [0061.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62e578, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 90 [0061.744] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xb4) returned 0x62e5f8 [0061.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62e578, cbMultiByte=-1, lpWideCharStr=0x62e5f8, cchWideChar=90 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\@@_README_@@.txt") returned 90 [0061.745] GetFileType (hFile=0x58) returned 0x1 [0061.745] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62e5f8 | out: hHeap=0x610000) returned 1 [0061.746] AreFileApisANSI () returned 1 [0061.746] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62e578, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 93 [0061.746] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xba) returned 0x62e5f8 [0061.746] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62e578, cbMultiByte=-1, lpWideCharStr=0x62e5f8, cchWideChar=93 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\@@_ATTENTION_@@.txt") returned 93 [0061.748] AreFileApisANSI () returned 1 [0061.748] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62e578, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 90 [0061.748] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xb4) returned 0x62e5f8 [0061.748] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62e578, cbMultiByte=-1, lpWideCharStr=0x62e5f8, cchWideChar=90 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\@@_HELPER_@@.txt") returned 90 [0061.750] FindFirstFileA (in: lpFileName="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe336f5e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe336f5e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3900073e, dwReserved1=0xcc, cFileName=".", cAlternateFileName="")) returned 0x628890 [0061.750] FindNextFileA (in: hFindFile=0x628890, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe336f5e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe336f5e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3900073e, dwReserved1=0xcc, cFileName="..", cAlternateFileName="")) returned 1 [0061.750] FindNextFileA (in: hFindFile=0x628890, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe336f5e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe336f5e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe336f5e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x3900073e, dwReserved1=0xcc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.750] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.750] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6288d0 [0061.750] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288d0 | out: hHeap=0x610000) returned 1 [0061.750] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624790 [0061.750] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624790 | out: hHeap=0x610000) returned 1 [0061.750] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.750] FindNextFileA (in: hFindFile=0x628890, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe336f5e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe336f5e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3395740, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6288c8, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.750] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.750] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6288d0 [0061.750] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288d0 | out: hHeap=0x610000) returned 1 [0061.750] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624790 [0061.750] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624790 | out: hHeap=0x610000) returned 1 [0061.750] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.750] FindNextFileA (in: hFindFile=0x628890, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe336f5e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe336f5e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe336f5e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6288c8, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.750] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.750] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6288d0 [0061.750] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288d0 | out: hHeap=0x610000) returned 1 [0061.750] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624790 [0061.750] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624790 | out: hHeap=0x610000) returned 1 [0061.750] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.750] FindNextFileA (in: hFindFile=0x628890, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x610000, dwReserved1=0x6288c8, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0061.751] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.751] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6288d0 [0061.751] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288d0 | out: hHeap=0x610000) returned 1 [0061.751] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.751] FindNextFileA (in: hFindFile=0x628890, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x610000, dwReserved1=0x6288c8, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0061.751] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.751] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6288d0 [0061.751] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288d0 | out: hHeap=0x610000) returned 1 [0061.751] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.751] FindNextFileA (in: hFindFile=0x628890, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x610000, dwReserved1=0x6288c8, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0061.751] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.751] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6288d0 [0061.751] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288d0 | out: hHeap=0x610000) returned 1 [0061.751] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.751] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.751] AreFileApisANSI () returned 1 [0061.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0061.751] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa6) returned 0x6288d0 [0061.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x6288d0, cchWideChar=83 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 83 [0061.754] AreFileApisANSI () returned 1 [0061.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0061.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6288d0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 92 [0061.754] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x15e) returned 0x628938 [0061.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x628938, cchWideChar=83 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 83 [0061.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6288d0, cbMultiByte=-1, lpWideCharStr=0x6289de, cchWideChar=92 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.isolated") returned 92 [0061.754] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.isolated"), dwFlags=0x2) returned 1 [0061.755] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628938 | out: hHeap=0x610000) returned 1 [0061.755] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288d0 | out: hHeap=0x610000) returned 1 [0061.755] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.755] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ea0 | out: hHeap=0x610000) returned 1 [0061.755] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.755] FindNextFileA (in: hFindFile=0x628890, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x610000, dwReserved1=0x6288c8, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0061.755] FindClose (in: hFindFile=0x628890 | out: hFindFile=0x628890) returned 1 [0061.755] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0061.755] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.755] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.755] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.755] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.755] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.755] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628848 [0061.755] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628da0 [0061.755] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x77) returned 0x62e578 [0061.755] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628da0 | out: hHeap=0x610000) returned 1 [0061.755] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.755] AreFileApisANSI () returned 1 [0061.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62e578, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 90 [0061.755] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xb4) returned 0x62e5f8 [0061.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62e578, cbMultiByte=-1, lpWideCharStr=0x62e5f8, cchWideChar=90 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\@@_README_@@.txt") returned 90 [0061.756] GetFileType (hFile=0x58) returned 0x1 [0061.756] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62e5f8 | out: hHeap=0x610000) returned 1 [0061.756] AreFileApisANSI () returned 1 [0061.757] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62e578, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 93 [0061.757] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xba) returned 0x62e5f8 [0061.757] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62e578, cbMultiByte=-1, lpWideCharStr=0x62e5f8, cchWideChar=93 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\@@_ATTENTION_@@.txt") returned 93 [0061.759] AreFileApisANSI () returned 1 [0061.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62e578, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 90 [0061.759] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xb4) returned 0x62e5f8 [0061.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62e578, cbMultiByte=-1, lpWideCharStr=0x62e5f8, cchWideChar=90 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\@@_HELPER_@@.txt") returned 90 [0061.760] FindFirstFileA (in: lpFileName="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe3395740, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3395740, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3900073e, dwReserved1=0xcc, cFileName=".", cAlternateFileName="")) returned 0x628890 [0061.761] FindNextFileA (in: hFindFile=0x628890, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe3395740, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3395740, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3900073e, dwReserved1=0xcc, cFileName="..", cAlternateFileName="")) returned 1 [0061.761] FindNextFileA (in: hFindFile=0x628890, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3395740, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3395740, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3395740, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x3900073e, dwReserved1=0xcc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.761] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.761] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6288d0 [0061.761] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288d0 | out: hHeap=0x610000) returned 1 [0061.761] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624790 [0061.761] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624790 | out: hHeap=0x610000) returned 1 [0061.761] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.761] FindNextFileA (in: hFindFile=0x628890, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3395740, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3395740, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3395740, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6288c8, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.761] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.761] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6288d0 [0061.761] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288d0 | out: hHeap=0x610000) returned 1 [0061.761] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624790 [0061.761] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624790 | out: hHeap=0x610000) returned 1 [0061.761] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.761] FindNextFileA (in: hFindFile=0x628890, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3395740, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3395740, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3395740, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6288c8, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.761] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.761] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6288d0 [0061.761] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288d0 | out: hHeap=0x610000) returned 1 [0061.761] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624790 [0061.761] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624790 | out: hHeap=0x610000) returned 1 [0061.761] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.761] FindNextFileA (in: hFindFile=0x628890, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x610000, dwReserved1=0x6288c8, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0061.761] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.761] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6288d0 [0061.761] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288d0 | out: hHeap=0x610000) returned 1 [0061.761] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.761] FindNextFileA (in: hFindFile=0x628890, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x610000, dwReserved1=0x6288c8, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0061.761] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.761] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6288d0 [0061.761] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288d0 | out: hHeap=0x610000) returned 1 [0061.761] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.761] FindNextFileA (in: hFindFile=0x628890, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x610000, dwReserved1=0x6288c8, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0061.761] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.762] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6288d0 [0061.762] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288d0 | out: hHeap=0x610000) returned 1 [0061.762] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.762] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.762] AreFileApisANSI () returned 1 [0061.762] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0061.762] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa6) returned 0x6288d0 [0061.762] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x6288d0, cchWideChar=83 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 83 [0061.765] AreFileApisANSI () returned 1 [0061.765] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0061.765] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6288d0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 92 [0061.765] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x15e) returned 0x628938 [0061.765] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x628938, cchWideChar=83 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 83 [0061.765] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6288d0, cbMultiByte=-1, lpWideCharStr=0x6289de, cchWideChar=92 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.isolated") returned 92 [0061.765] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.isolated"), dwFlags=0x2) returned 1 [0061.766] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628938 | out: hHeap=0x610000) returned 1 [0061.766] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288d0 | out: hHeap=0x610000) returned 1 [0061.766] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.766] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ea0 | out: hHeap=0x610000) returned 1 [0061.766] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.766] FindNextFileA (in: hFindFile=0x628890, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x610000, dwReserved1=0x6288c8, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0061.766] FindClose (in: hFindFile=0x628890 | out: hFindFile=0x628890) returned 1 [0061.766] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0061.766] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.766] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.766] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.766] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.766] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0061.766] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.766] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.766] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.766] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.766] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.766] AreFileApisANSI () returned 1 [0061.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77 [0061.766] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x9a) returned 0x6287f0 [0061.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6287f0, cchWideChar=77 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 77 [0061.769] AreFileApisANSI () returned 1 [0061.769] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77 [0061.769] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 86 [0061.769] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x146) returned 0x6288b0 [0061.769] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6288b0, cchWideChar=77 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 77 [0061.769] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x62894a, cchWideChar=86 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.isolated") returned 86 [0061.769] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.isolated"), dwFlags=0x2) returned 1 [0061.769] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288b0 | out: hHeap=0x610000) returned 1 [0061.769] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.769] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.769] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ea0 | out: hHeap=0x610000) returned 1 [0061.769] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.769] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0061.769] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.769] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.769] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.769] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.770] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.770] AreFileApisANSI () returned 1 [0061.770] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0061.770] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x94) returned 0x6287f0 [0061.770] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6287f0, cchWideChar=74 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 74 [0061.777] AreFileApisANSI () returned 1 [0061.777] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0061.777] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0061.777] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x13a) returned 0x6288b0 [0061.777] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6288b0, cchWideChar=74 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 74 [0061.777] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x628944, cchWideChar=83 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.isolated") returned 83 [0061.777] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.isolated"), dwFlags=0x2) returned 1 [0061.778] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288b0 | out: hHeap=0x610000) returned 1 [0061.778] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.778] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.778] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ea0 | out: hHeap=0x610000) returned 1 [0061.778] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.778] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0061.778] FindClose (in: hFindFile=0x628770 | out: hFindFile=0x628770) returned 1 [0061.778] FindNextFileA (in: hFindFile=0x6287b0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0061.778] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x6287f0 [0061.778] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628838 [0061.778] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628880 [0061.778] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628838 | out: hHeap=0x610000) returned 1 [0061.778] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628880 | out: hHeap=0x610000) returned 1 [0061.778] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.778] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x6287f0 [0061.778] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628838 [0061.778] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628d90 [0061.778] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x77) returned 0x62d570 [0061.778] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d90 | out: hHeap=0x610000) returned 1 [0061.778] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.778] AreFileApisANSI () returned 1 [0061.779] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.779] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa2) returned 0x628d90 [0061.779] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x628d90, cchWideChar=81 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\@@_README_@@.txt") returned 81 [0061.781] AreFileApisANSI () returned 1 [0061.781] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0061.781] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa8) returned 0x628d90 [0061.781] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x628d90, cchWideChar=84 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\@@_ATTENTION_@@.txt") returned 84 [0061.782] AreFileApisANSI () returned 1 [0061.783] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.783] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa2) returned 0x628d90 [0061.783] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x628d90, cchWideChar=81 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\@@_HELPER_@@.txt") returned 81 [0061.784] FindFirstFileA (in: lpFileName="C:\\\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe33e1a00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe33e1a00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3600093f, dwReserved1=0xcc, cFileName=".", cAlternateFileName="")) returned 0x628770 [0061.784] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe33e1a00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe33e1a00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3600093f, dwReserved1=0xcc, cFileName="..", cAlternateFileName="")) returned 1 [0061.784] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe33e1a00, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe33e1a00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe33e1a00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x3600093f, dwReserved1=0xcc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.784] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.784] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.784] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.784] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624790 [0061.784] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624790 | out: hHeap=0x610000) returned 1 [0061.784] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.784] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe33e1a00, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe33e1a00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe33e1a00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.784] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.784] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.784] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.785] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624790 [0061.785] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624790 | out: hHeap=0x610000) returned 1 [0061.785] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.785] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe33e1a00, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe33e1a00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe33e1a00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.785] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.785] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.785] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.785] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624790 [0061.785] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624790 | out: hHeap=0x610000) returned 1 [0061.785] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.785] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0061.785] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.785] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.785] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.785] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.785] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0061.785] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.785] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.785] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.785] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.785] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.785] AreFileApisANSI () returned 1 [0061.785] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 80 [0061.785] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa0) returned 0x6287f0 [0061.785] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6287f0, cchWideChar=80 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 80 [0061.788] AreFileApisANSI () returned 1 [0061.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 80 [0061.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 89 [0061.788] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x152) returned 0x6288b0 [0061.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6288b0, cchWideChar=80 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 80 [0061.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x628950, cchWideChar=89 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.isolated") returned 89 [0061.788] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.isolated"), dwFlags=0x2) returned 1 [0061.789] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288b0 | out: hHeap=0x610000) returned 1 [0061.789] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.789] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.789] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ea0 | out: hHeap=0x610000) returned 1 [0061.789] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.789] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0061.789] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.789] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.789] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.789] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.789] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0061.789] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.789] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.789] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.789] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.789] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.789] AreFileApisANSI () returned 1 [0061.789] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0061.789] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x94) returned 0x6287f0 [0061.789] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6287f0, cchWideChar=74 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 74 [0061.796] AreFileApisANSI () returned 1 [0061.796] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0061.796] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0061.796] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x13a) returned 0x6288b0 [0061.796] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6288b0, cchWideChar=74 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 74 [0061.796] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x628944, cchWideChar=83 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.isolated") returned 83 [0061.796] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.isolated"), dwFlags=0x2) returned 1 [0061.796] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288b0 | out: hHeap=0x610000) returned 1 [0061.796] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.796] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.796] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ea0 | out: hHeap=0x610000) returned 1 [0061.796] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.796] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0061.796] FindClose (in: hFindFile=0x628770 | out: hFindFile=0x628770) returned 1 [0061.797] FindNextFileA (in: hFindFile=0x6287b0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0061.797] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x6287f0 [0061.797] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628838 [0061.797] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x628880 [0061.797] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628838 | out: hHeap=0x610000) returned 1 [0061.797] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628880 | out: hHeap=0x610000) returned 1 [0061.797] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.797] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x6287f0 [0061.797] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x550) returned 0x628838 [0061.797] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628d90 [0061.797] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x77) returned 0x62d570 [0061.797] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628d90 | out: hHeap=0x610000) returned 1 [0061.797] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.797] AreFileApisANSI () returned 1 [0061.797] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.797] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa2) returned 0x628d90 [0061.797] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x628d90, cchWideChar=81 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\@@_README_@@.txt") returned 81 [0061.800] AreFileApisANSI () returned 1 [0061.800] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0061.800] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa8) returned 0x628d90 [0061.800] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x628d90, cchWideChar=84 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\@@_ATTENTION_@@.txt") returned 84 [0061.803] AreFileApisANSI () returned 1 [0061.803] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.803] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa2) returned 0x628d90 [0061.803] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x628d90, cchWideChar=81 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\@@_HELPER_@@.txt") returned 81 [0061.807] FindFirstFileA (in: lpFileName="C:\\\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe3407b60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3407b60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3600093f, dwReserved1=0xcc, cFileName=".", cAlternateFileName="")) returned 0x628770 [0061.807] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe3407b60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3407b60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3600093f, dwReserved1=0xcc, cFileName="..", cAlternateFileName="")) returned 1 [0061.807] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3407b60, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3407b60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3407b60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x3600093f, dwReserved1=0xcc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.807] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.807] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.807] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.807] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624790 [0061.807] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624790 | out: hHeap=0x610000) returned 1 [0061.807] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.807] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3407b60, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3407b60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3407b60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.807] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.807] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.807] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.807] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624790 [0061.807] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624790 | out: hHeap=0x610000) returned 1 [0061.807] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.807] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3407b60, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3407b60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3407b60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.807] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x6287f0 [0061.807] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x60) returned 0x628858 [0061.807] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x610000) returned 1 [0061.807] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x624790 [0061.807] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624790 | out: hHeap=0x610000) returned 1 [0061.807] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.807] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0061.807] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.807] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.807] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.807] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.807] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0061.807] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.807] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.808] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.808] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.808] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0061.808] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.808] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x628848 [0061.808] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.808] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.808] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x6282a0 [0061.808] AreFileApisANSI () returned 1 [0061.808] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 80 [0061.808] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa0) returned 0x6287f0 [0061.808] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6287f0, cchWideChar=80 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 80 [0061.811] AreFileApisANSI () returned 1 [0061.811] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 80 [0061.811] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 89 [0061.811] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x152) returned 0x6288b0 [0061.811] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x6288b0, cchWideChar=80 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 80 [0061.811] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x628950, cchWideChar=89 | out: lpWideCharStr="C:\\\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.isolated") returned 89 [0061.811] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.isolated"), dwFlags=0x2) returned 1 [0061.811] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288b0 | out: hHeap=0x610000) returned 1 [0061.811] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.811] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.812] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ea0 | out: hHeap=0x610000) returned 1 [0061.812] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.812] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0061.812] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x50) returned 0x6287f0 [0061.812] AreFileApisANSI () returned 1 [0061.812] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0061.816] AreFileApisANSI () returned 1 [0061.816] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0061.816] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0061.816] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.isolated"), dwFlags=0x2) returned 1 [0061.816] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288b0 | out: hHeap=0x610000) returned 1 [0061.816] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.816] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.817] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ea0 | out: hHeap=0x610000) returned 1 [0061.817] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.817] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0061.817] FindClose (in: hFindFile=0x628770 | out: hFindFile=0x628770) returned 1 [0061.817] FindNextFileA (in: hFindFile=0x6287b0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0061.817] AreFileApisANSI () returned 1 [0061.817] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.819] AreFileApisANSI () returned 1 [0061.820] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0061.820] AreFileApisANSI () returned 1 [0061.821] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.822] FindFirstFileA (in: lpFileName="C:\\\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xe342dcc0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe342dcc0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3600093f, dwReserved1=0xcc, cFileName=".", cAlternateFileName="")) returned 0x628770 [0061.822] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xe342dcc0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe342dcc0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3600093f, dwReserved1=0xcc, cFileName="..", cAlternateFileName="")) returned 1 [0061.822] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe342dcc0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe342dcc0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe342dcc0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x3600093f, dwReserved1=0xcc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.822] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe342dcc0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe342dcc0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe342dcc0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.822] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe342dcc0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe342dcc0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe342dcc0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.822] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0061.822] AreFileApisANSI () returned 1 [0061.822] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0061.831] AreFileApisANSI () returned 1 [0061.831] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0061.831] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0061.831] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.isolated"), dwFlags=0x2) returned 1 [0061.831] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288b0 | out: hHeap=0x610000) returned 1 [0061.831] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.831] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.831] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ea0 | out: hHeap=0x610000) returned 1 [0061.831] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.831] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0061.831] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0061.831] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0061.831] AreFileApisANSI () returned 1 [0061.832] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77 [0061.843] AreFileApisANSI () returned 1 [0061.843] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77 [0061.843] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 86 [0061.843] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.isolated"), dwFlags=0x2) returned 1 [0061.844] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288b0 | out: hHeap=0x610000) returned 1 [0061.844] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.844] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.844] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ea0 | out: hHeap=0x610000) returned 1 [0061.844] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.844] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0061.844] FindClose (in: hFindFile=0x628770 | out: hFindFile=0x628770) returned 1 [0061.844] FindNextFileA (in: hFindFile=0x6287b0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0061.844] AreFileApisANSI () returned 1 [0061.844] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.848] AreFileApisANSI () returned 1 [0061.848] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0061.849] AreFileApisANSI () returned 1 [0061.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.850] FindFirstFileA (in: lpFileName="C:\\\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe3479f80, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3479f80, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3600093f, dwReserved1=0xcc, cFileName=".", cAlternateFileName="")) returned 0x628770 [0061.850] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe3479f80, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3479f80, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3600093f, dwReserved1=0xcc, cFileName="..", cAlternateFileName="")) returned 1 [0061.850] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3479f80, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3479f80, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3479f80, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x3600093f, dwReserved1=0xcc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.850] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3479f80, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3479f80, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3479f80, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.850] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3479f80, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3479f80, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3479f80, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.850] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0061.850] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0061.850] AreFileApisANSI () returned 1 [0061.850] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 79 [0061.853] AreFileApisANSI () returned 1 [0061.853] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 79 [0061.853] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0061.853] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.isolated"), dwFlags=0x2) returned 1 [0061.854] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288b0 | out: hHeap=0x610000) returned 1 [0061.854] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628848 | out: hHeap=0x610000) returned 1 [0061.854] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6287f0 | out: hHeap=0x610000) returned 1 [0061.854] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x623ea0 | out: hHeap=0x610000) returned 1 [0061.854] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6282a0 | out: hHeap=0x610000) returned 1 [0061.854] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0061.854] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0061.854] AreFileApisANSI () returned 1 [0061.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0061.861] AreFileApisANSI () returned 1 [0061.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0061.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0061.861] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.isolated"), dwFlags=0x2) returned 1 [0061.861] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6288b0 | out: hHeap=0x610000) returned 1 [0061.861] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0061.861] FindClose (in: hFindFile=0x628770 | out: hFindFile=0x628770) returned 1 [0061.861] FindNextFileA (in: hFindFile=0x6287b0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0061.862] AreFileApisANSI () returned 1 [0061.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.865] AreFileApisANSI () returned 1 [0061.865] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0061.867] AreFileApisANSI () returned 1 [0061.867] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.868] FindFirstFileA (in: lpFileName="C:\\\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xe34a00e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe34a00e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3600093f, dwReserved1=0xcc, cFileName=".", cAlternateFileName="")) returned 0x628770 [0061.868] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xe34a00e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe34a00e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3600093f, dwReserved1=0xcc, cFileName="..", cAlternateFileName="")) returned 1 [0061.868] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe34a00e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe34a00e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe34a00e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x3600093f, dwReserved1=0xcc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.868] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe34a00e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe34a00e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe34a00e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.868] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe34a00e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe34a00e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe34a00e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.868] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0061.868] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0061.868] AreFileApisANSI () returned 1 [0061.868] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 79 [0061.871] AreFileApisANSI () returned 1 [0061.871] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 79 [0061.872] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0061.872] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.isolated"), dwFlags=0x2) returned 1 [0061.872] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0061.872] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0061.872] AreFileApisANSI () returned 1 [0061.872] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0061.877] AreFileApisANSI () returned 1 [0061.877] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0061.877] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0061.877] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.isolated"), dwFlags=0x2) returned 1 [0061.877] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0061.877] FindClose (in: hFindFile=0x628770 | out: hFindFile=0x628770) returned 1 [0061.878] FindNextFileA (in: hFindFile=0x6287b0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0061.878] AreFileApisANSI () returned 1 [0061.878] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.880] AreFileApisANSI () returned 1 [0061.880] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0061.882] AreFileApisANSI () returned 1 [0061.882] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.889] FindFirstFileA (in: lpFileName="C:\\\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe34c6240, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe34c6240, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3600093f, dwReserved1=0xcc, cFileName=".", cAlternateFileName="")) returned 0x628770 [0061.889] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe34c6240, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe34c6240, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3600093f, dwReserved1=0xcc, cFileName="..", cAlternateFileName="")) returned 1 [0061.889] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe34c6240, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe34c6240, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe34c6240, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x3600093f, dwReserved1=0xcc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.889] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe34c6240, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe34c6240, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe34c6240, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.889] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe34c6240, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe34c6240, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe34c6240, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.889] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0061.889] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0061.889] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0061.889] AreFileApisANSI () returned 1 [0061.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0061.892] AreFileApisANSI () returned 1 [0061.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0061.892] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0061.892] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.isolated"), dwFlags=0x2) returned 1 [0061.893] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0061.893] AreFileApisANSI () returned 1 [0061.893] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0061.896] AreFileApisANSI () returned 1 [0061.896] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0061.896] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0061.896] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.isolated"), dwFlags=0x2) returned 1 [0061.896] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0061.896] FindClose (in: hFindFile=0x628770 | out: hFindFile=0x628770) returned 1 [0061.897] FindNextFileA (in: hFindFile=0x6287b0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0061.897] AreFileApisANSI () returned 1 [0061.897] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.899] AreFileApisANSI () returned 1 [0061.899] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0061.901] AreFileApisANSI () returned 1 [0061.901] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0061.903] FindFirstFileA (in: lpFileName="C:\\\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe34ec3a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe34ec3a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3600093f, dwReserved1=0xcc, cFileName=".", cAlternateFileName="")) returned 0x628770 [0061.903] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe34ec3a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe34ec3a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3600093f, dwReserved1=0xcc, cFileName="..", cAlternateFileName="")) returned 1 [0061.903] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3600093f, dwReserved1=0xcc, cFileName="1033", cAlternateFileName="")) returned 1 [0061.903] AreFileApisANSI () returned 1 [0061.903] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62e578, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 86 [0061.904] GetFileType (hFile=0x58) returned 0x1 [0061.904] AreFileApisANSI () returned 1 [0061.904] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62e578, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 89 [0061.906] AreFileApisANSI () returned 1 [0061.906] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62e578, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 86 [0061.908] FindFirstFileA (in: lpFileName="C:\\\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe3512500, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3512500, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3900073e, dwReserved1=0xcc, cFileName=".", cAlternateFileName="")) returned 0x628888 [0061.908] FindNextFileA (in: hFindFile=0x628888, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe3512500, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3512500, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3900073e, dwReserved1=0xcc, cFileName="..", cAlternateFileName="")) returned 1 [0061.908] FindNextFileA (in: hFindFile=0x628888, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe34ec3a0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe34ec3a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3512500, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x3900073e, dwReserved1=0xcc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.908] FindNextFileA (in: hFindFile=0x628888, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3512500, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3512500, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3512500, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6288c0, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.908] FindNextFileA (in: hFindFile=0x628888, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe34ec3a0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe34ec3a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe34ec3a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6288c0, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.908] FindNextFileA (in: hFindFile=0x628888, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x610000, dwReserved1=0x6288c0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0061.908] FindNextFileA (in: hFindFile=0x628888, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x610000, dwReserved1=0x6288c0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0061.908] FindClose (in: hFindFile=0x628888 | out: hFindFile=0x628888) returned 1 [0061.909] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe34ec3a0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe34ec3a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe34ec3a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0061.909] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe34ec3a0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe34ec3a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe34ec3a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0061.909] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe34ec3a0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe34ec3a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe34ec3a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0061.909] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0061.909] AreFileApisANSI () returned 1 [0061.909] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77 [0062.435] AreFileApisANSI () returned 1 [0062.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77 [0062.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 86 [0062.435] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.isolated"), dwFlags=0x2) returned 1 [0062.437] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0062.437] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0062.437] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0062.437] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0062.437] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0062.437] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0062.437] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0062.437] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0062.437] AreFileApisANSI () returned 1 [0062.437] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0062.444] AreFileApisANSI () returned 1 [0062.444] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0062.444] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0062.444] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.isolated"), dwFlags=0x2) returned 1 [0062.445] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0062.445] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0062.445] AreFileApisANSI () returned 1 [0062.445] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0062.447] AreFileApisANSI () returned 1 [0062.447] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0062.447] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628858, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 90 [0062.447] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.isolated"), dwFlags=0x2) returned 1 [0062.448] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0062.448] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0062.448] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0062.448] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0062.448] AreFileApisANSI () returned 1 [0062.448] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0062.459] AreFileApisANSI () returned 1 [0062.459] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0062.459] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0062.459] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.isolated"), dwFlags=0x2) returned 1 [0062.459] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0062.459] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0 [0062.460] FindClose (in: hFindFile=0x628770 | out: hFindFile=0x628770) returned 1 [0062.460] FindNextFileA (in: hFindFile=0x6287b0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0062.460] AreFileApisANSI () returned 1 [0062.460] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0062.463] AreFileApisANSI () returned 1 [0062.463] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0062.464] AreFileApisANSI () returned 1 [0062.464] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0062.465] FindFirstFileA (in: lpFileName="C:\\\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe3a47520, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3a47520, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3600093f, dwReserved1=0xcc, cFileName=".", cAlternateFileName="")) returned 0x628770 [0062.465] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe3a47520, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3a47520, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3600093f, dwReserved1=0xcc, cFileName="..", cAlternateFileName="")) returned 1 [0062.465] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a47520, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3a47520, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3a47520, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x3600093f, dwReserved1=0xcc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0062.465] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a47520, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3a47520, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3a47520, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0062.466] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a47520, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3a47520, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3a47520, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0062.466] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0062.466] AreFileApisANSI () returned 1 [0062.466] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62e578, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 94 [0062.469] AreFileApisANSI () returned 1 [0062.469] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62e578, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 97 [0062.470] AreFileApisANSI () returned 1 [0062.470] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62e578, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 94 [0062.471] FindFirstFileA (in: lpFileName="C:\\\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe3a6d680, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3a6d680, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3900073e, dwReserved1=0xcc, cFileName=".", cAlternateFileName="")) returned 0x628898 [0062.471] FindNextFileA (in: hFindFile=0x628898, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe3a6d680, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3a6d680, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3900073e, dwReserved1=0xcc, cFileName="..", cAlternateFileName="")) returned 1 [0062.471] FindNextFileA (in: hFindFile=0x628898, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a6d680, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3a6d680, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3a6d680, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x3900073e, dwReserved1=0xcc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0062.472] FindNextFileA (in: hFindFile=0x628898, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a6d680, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3a6d680, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3a6d680, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6288d0, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0062.472] FindNextFileA (in: hFindFile=0x628898, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a6d680, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3a6d680, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3a6d680, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6288d0, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0062.472] FindNextFileA (in: hFindFile=0x628898, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x610000, dwReserved1=0x6288d0, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0062.472] FindNextFileA (in: hFindFile=0x628898, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x610000, dwReserved1=0x6288d0, cFileName="AccessMUI.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0062.472] AreFileApisANSI () returned 1 [0062.472] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 91 [0062.475] AreFileApisANSI () returned 1 [0062.475] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 91 [0062.475] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6288d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 100 [0062.475] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.isolated"), dwFlags=0x2) returned 1 [0062.475] FindNextFileA (in: hFindFile=0x628898, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0062.475] FindNextFileA (in: hFindFile=0x628898, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x610000, dwReserved1=0x6288d0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0062.476] AreFileApisANSI () returned 1 [0062.476] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 90 [0062.974] AreFileApisANSI () returned 1 [0062.975] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 90 [0062.975] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6288d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 99 [0062.975] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.isolated"), dwFlags=0x2) returned 1 [0062.975] FindNextFileA (in: hFindFile=0x628898, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x610000, dwReserved1=0x6288d0, cFileName="branding.xml", cAlternateFileName="")) returned 0 [0062.975] FindClose (in: hFindFile=0x628898 | out: hFindFile=0x628898) returned 1 [0062.975] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0062.975] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="AccessMUISet.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0062.975] AreFileApisANSI () returned 1 [0062.975] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0062.978] AreFileApisANSI () returned 1 [0062.978] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0062.978] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628858, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 90 [0062.978] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.isolated"), dwFlags=0x2) returned 1 [0062.979] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0062.979] AreFileApisANSI () returned 1 [0062.979] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0062.983] AreFileApisANSI () returned 1 [0062.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0062.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0062.983] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.isolated" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.isolated"), dwFlags=0x2) returned 1 [0062.983] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0062.983] FindClose (in: hFindFile=0x628770 | out: hFindFile=0x628770) returned 1 [0062.983] FindNextFileA (in: hFindFile=0x6287b0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~1")) returned 1 [0062.983] AreFileApisANSI () returned 1 [0062.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0062.987] AreFileApisANSI () returned 1 [0062.987] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0062.988] AreFileApisANSI () returned 1 [0062.988] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0062.989] FindFirstFileA (in: lpFileName="C:\\\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe3f563e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3f563e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4800054d, dwReserved1=0xcc, cFileName=".", cAlternateFileName="")) returned 0x628770 [0062.989] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe3f563e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3f563e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4800054d, dwReserved1=0xcc, cFileName="..", cAlternateFileName="")) returned 1 [0062.989] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3f563e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3f563e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3f563e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x4800054d, dwReserved1=0xcc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0062.989] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3f563e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3f563e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3f563e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0062.989] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3f563e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3f563e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3f563e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0062.989] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0062.989] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0062.989] AreFileApisANSI () returned 1 [0062.989] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 79 [0062.995] AreFileApisANSI () returned 1 [0062.995] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 79 [0062.995] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0062.995] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.isolated" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.isolated"), dwFlags=0x2) returned 1 [0062.996] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0062.996] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0062.996] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0062.996] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0062.996] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0062.996] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="ProPlusrWW.msi", cAlternateFileName="PROPLU~1.MSI")) returned 1 [0062.996] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="ProPlusrWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 1 [0062.996] AreFileApisANSI () returned 1 [0062.996] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 79 [0063.014] AreFileApisANSI () returned 1 [0063.014] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 79 [0063.014] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0063.014] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.isolated" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.isolated"), dwFlags=0x2) returned 1 [0063.015] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="ProPrWW.cab", cAlternateFileName="")) returned 1 [0063.015] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="ProPrWW2.cab", cAlternateFileName="")) returned 1 [0063.015] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0063.015] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0063.015] AreFileApisANSI () returned 1 [0063.015] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0063.053] AreFileApisANSI () returned 1 [0063.053] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0063.053] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0063.053] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.isolated" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.isolated"), dwFlags=0x2) returned 1 [0063.053] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0063.053] FindClose (in: hFindFile=0x628770 | out: hFindFile=0x628770) returned 1 [0063.053] FindNextFileA (in: hFindFile=0x6287b0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0063.053] AreFileApisANSI () returned 1 [0063.053] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0063.057] AreFileApisANSI () returned 1 [0063.057] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0063.058] AreFileApisANSI () returned 1 [0063.058] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0063.059] FindFirstFileA (in: lpFileName="C:\\\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xe3fee960, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3fee960, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4800054d, dwReserved1=0xcc, cFileName=".", cAlternateFileName="")) returned 0x628770 [0063.059] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xe3fee960, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3fee960, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4800054d, dwReserved1=0xcc, cFileName="..", cAlternateFileName="")) returned 1 [0063.059] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3fee960, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3fee960, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3fee960, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x4800054d, dwReserved1=0xcc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0063.059] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3fee960, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3fee960, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3fee960, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0063.059] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3fee960, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe3fee960, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe3fee960, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0063.060] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0063.060] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0063.060] AreFileApisANSI () returned 1 [0063.060] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 79 [0063.066] AreFileApisANSI () returned 1 [0063.066] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 79 [0063.066] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0063.066] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.isolated" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.isolated"), dwFlags=0x2) returned 1 [0063.066] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0063.066] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0063.066] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0063.066] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0063.066] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0063.067] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="PrjProrWW.msi", cAlternateFileName="PRJPRO~1.MSI")) returned 1 [0063.067] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="PrjProrWW.xml", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0063.067] AreFileApisANSI () returned 1 [0063.067] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.075] AreFileApisANSI () returned 1 [0063.075] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.075] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0063.075] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.isolated" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.isolated"), dwFlags=0x2) returned 1 [0063.076] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="PrjPrrWW.cab", cAlternateFileName="")) returned 1 [0063.076] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0063.076] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0063.076] AreFileApisANSI () returned 1 [0063.076] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0063.095] AreFileApisANSI () returned 1 [0063.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0063.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0063.095] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.isolated" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.isolated"), dwFlags=0x2) returned 1 [0063.095] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0063.095] FindClose (in: hFindFile=0x628770 | out: hFindFile=0x628770) returned 1 [0063.095] FindNextFileA (in: hFindFile=0x6287b0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0063.095] AreFileApisANSI () returned 1 [0063.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0063.100] AreFileApisANSI () returned 1 [0063.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0063.101] AreFileApisANSI () returned 1 [0063.101] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x62d570, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0063.103] FindFirstFileA (in: lpFileName="C:\\\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xe4060d80, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4060d80, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4800054d, dwReserved1=0xcc, cFileName=".", cAlternateFileName="")) returned 0x628770 [0063.103] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xe4060d80, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4060d80, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4800054d, dwReserved1=0xcc, cFileName="..", cAlternateFileName="")) returned 1 [0063.103] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe4060d80, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe4060d80, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4060d80, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x4800054d, dwReserved1=0xcc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0063.103] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe4060d80, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe4060d80, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4060d80, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0063.103] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe4060d80, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe4060d80, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4060d80, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0063.103] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0063.103] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0063.103] AreFileApisANSI () returned 1 [0063.103] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 79 [0063.110] AreFileApisANSI () returned 1 [0063.110] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 79 [0063.110] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0063.110] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.isolated" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.isolated"), dwFlags=0x2) returned 1 [0063.111] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0063.111] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0063.111] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0063.111] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0063.111] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0063.111] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0063.111] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0063.111] AreFileApisANSI () returned 1 [0063.111] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0063.132] AreFileApisANSI () returned 1 [0063.132] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0063.132] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0063.132] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.isolated" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.isolated"), dwFlags=0x2) returned 1 [0063.133] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="VisiorWW.cab", cAlternateFileName="")) returned 1 [0063.133] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="VisiorWW.msi", cAlternateFileName="")) returned 1 [0063.133] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 1 [0063.133] AreFileApisANSI () returned 1 [0063.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77 [0063.144] AreFileApisANSI () returned 1 [0063.144] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18dda4, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77 [0063.144] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628848, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 86 [0063.144] MoveFileExW (lpExistingFileName="C:\\\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), lpNewFileName="C:\\\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.isolated" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.isolated"), dwFlags=0x2) returned 1 [0063.144] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 0 [0063.144] FindClose (in: hFindFile=0x628770 | out: hFindFile=0x628770) returned 1 [0063.144] FindNextFileA (in: hFindFile=0x6287b0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 0 [0063.144] FindClose (in: hFindFile=0x6287b0 | out: hFindFile=0x6287b0) returned 1 [0063.145] FindNextFileA (in: hFindFile=0x623e60, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610000, dwReserved1=0x6287a0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 0 [0063.145] FindClose (in: hFindFile=0x623e60 | out: hFindFile=0x623e60) returned 1 [0063.145] FindNextFileA (in: hFindFile=0x623e20, lpFindFileData=0x18f490 | out: lpFindFileData=0x18f490*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xde2809e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0xa2726000, dwReserved0=0xa0000003, dwReserved1=0x7716387a, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0063.145] FindNextFileA (in: hFindFile=0x623e20, lpFindFileData=0x18f490 | out: lpFindFileData=0x18f490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7716387a, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0063.145] AreFileApisANSI () returned 1 [0063.145] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624790, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 30 [0063.147] GetFileType (hFile=0x4c) returned 0x1 [0063.148] AreFileApisANSI () returned 1 [0063.148] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x623e60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 33 [0063.149] AreFileApisANSI () returned 1 [0063.150] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x624790, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 30 [0063.152] FindFirstFileA (in: lpFileName="C:\\\\PerfLogs\\*", lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe40d31a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe40d31a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc000804, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x623e60 [0063.152] FindNextFileA (in: hFindFile=0x623e60, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe40d31a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe40d31a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc000804, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0063.152] FindNextFileA (in: hFindFile=0x623e60, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40d31a0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe40d31a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe40d31a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0xc000804, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0063.152] FindNextFileA (in: hFindFile=0x623e60, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40d31a0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe40d31a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe40d31a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6287a0, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0063.152] FindNextFileA (in: hFindFile=0x623e60, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40d31a0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe40d31a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe40d31a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6287a0, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0063.152] FindNextFileA (in: hFindFile=0x623e60, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610000, dwReserved1=0x6287a0, cFileName="Admin", cAlternateFileName="")) returned 1 [0063.152] AreFileApisANSI () returned 1 [0063.152] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 36 [0063.153] GetFileType (hFile=0x50) returned 0x1 [0063.154] AreFileApisANSI () returned 1 [0063.154] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 39 [0063.155] AreFileApisANSI () returned 1 [0063.155] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 36 [0063.159] FindFirstFileA (in: lpFileName="C:\\\\PerfLogs\\Admin\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe40f9300, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe40f9300, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc000804, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287a8 [0063.160] FindNextFileA (in: hFindFile=0x6287a8, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe40f9300, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe40f9300, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc000804, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0063.160] FindNextFileA (in: hFindFile=0x6287a8, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40f9300, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe40f9300, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe40f9300, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0xc000804, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0063.160] FindNextFileA (in: hFindFile=0x6287a8, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40f9300, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe40f9300, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe40f9300, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6287e0, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0063.160] FindNextFileA (in: hFindFile=0x6287a8, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40f9300, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe40f9300, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe40f9300, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6287e0, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0063.160] FindNextFileA (in: hFindFile=0x6287a8, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40f9300, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe40f9300, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe40f9300, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6287e0, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 0 [0063.160] FindClose (in: hFindFile=0x6287a8 | out: hFindFile=0x6287a8) returned 1 [0063.160] FindNextFileA (in: hFindFile=0x623e60, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610000, dwReserved1=0x6287a0, cFileName="Admin", cAlternateFileName="")) returned 0 [0063.160] FindClose (in: hFindFile=0x623e60 | out: hFindFile=0x623e60) returned 1 [0063.160] FindNextFileA (in: hFindFile=0x623e20, lpFindFileData=0x18f490 | out: lpFindFileData=0x18f490*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xcefded90, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xcefded90, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7716387a, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0063.160] AreFileApisANSI () returned 1 [0063.160] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x623e60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0063.161] GetFileType (hFile=0x4c) returned 0x1 [0063.162] AreFileApisANSI () returned 1 [0063.162] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x623e60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0063.162] GetFileType (hFile=0x4c) returned 0x1 [0063.163] AreFileApisANSI () returned 1 [0063.163] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x623e60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0063.164] GetFileType (hFile=0x4c) returned 0x1 [0063.165] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\*", lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe40f9300, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe40f9300, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc000804, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x623e90 [0063.165] FindNextFileA (in: hFindFile=0x623e90, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe40f9300, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe40f9300, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc000804, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0063.165] FindNextFileA (in: hFindFile=0x623e90, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40f9300, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe40f9300, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe40f9300, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0xc000804, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0063.165] FindNextFileA (in: hFindFile=0x623e90, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40f9300, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe40f9300, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe40f9300, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6287a0, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0063.165] FindNextFileA (in: hFindFile=0x623e90, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40f9300, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe40f9300, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe40f9300, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6287a0, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0063.165] FindNextFileA (in: hFindFile=0x623e90, lpFindFileData=0x18eb2c | out: lpFindFileData=0x18eb2c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc7f65e10, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xc7f65e10, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610000, dwReserved1=0x6287a0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0063.165] AreFileApisANSI () returned 1 [0063.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 48 [0063.165] GetFileType (hFile=0x50) returned 0x1 [0063.166] AreFileApisANSI () returned 1 [0063.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 51 [0063.167] GetFileType (hFile=0x50) returned 0x1 [0063.167] AreFileApisANSI () returned 1 [0063.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628cc8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 48 [0063.168] GetFileType (hFile=0x50) returned 0x1 [0063.175] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe40f9300, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe40f9300, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc000804, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287c0 [0063.176] FindNextFileA (in: hFindFile=0x6287c0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe40f9300, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe40f9300, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc000804, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0063.176] FindNextFileA (in: hFindFile=0x6287c0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40f9300, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe40f9300, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe40f9300, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0xc000804, dwReserved1=0xdc, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0063.176] FindNextFileA (in: hFindFile=0x6287c0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40f9300, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe40f9300, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe411f460, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6287f8, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0063.176] FindNextFileA (in: hFindFile=0x6287c0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40f9300, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe40f9300, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe40f9300, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6287f8, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0063.176] FindNextFileA (in: hFindFile=0x6287c0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c570090, ftCreationTime.dwHighDateTime=0x1d4fb7a, ftLastAccessTime.dwLowDateTime=0x8c806ff0, ftLastAccessTime.dwHighDateTime=0x1d51c95, ftLastWriteTime.dwLowDateTime=0x8c806ff0, ftLastWriteTime.dwHighDateTime=0x1d51c95, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x610000, dwReserved1=0x6287f8, cFileName="brooks-chester.exe", cAlternateFileName="BROOKS~1.EXE")) returned 1 [0063.176] FindNextFileA (in: hFindFile=0x6287c0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610000, dwReserved1=0x6287f8, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0063.176] AreFileApisANSI () returned 1 [0063.176] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628d90, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 57 [0063.176] GetFileType (hFile=0x54) returned 0x1 [0063.178] AreFileApisANSI () returned 1 [0063.178] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628d90, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 60 [0063.179] AreFileApisANSI () returned 1 [0063.179] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628d90, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 57 [0063.195] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe41455c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe41455c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc000804, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628770 [0063.196] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe41455c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe41455c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc000804, dwReserved1=0x80, cFileName="..", cAlternateFileName="")) returned 1 [0063.196] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe411f460, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe411f460, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe411f460, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0xc000804, dwReserved1=0x80, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0063.196] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe411f460, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe411f460, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe41455c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0063.196] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe411f460, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe411f460, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe411f460, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0063.196] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0063.196] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x610000, dwReserved1=0x628840, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0063.196] FindClose (in: hFindFile=0x628770 | out: hFindFile=0x628770) returned 1 [0063.196] FindNextFileA (in: hFindFile=0x6287c0, lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0063.196] AreFileApisANSI () returned 1 [0063.196] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628da0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0063.201] GetFileType (hFile=0x54) returned 0x1 [0063.202] AreFileApisANSI () returned 1 [0063.202] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628da0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68 [0063.203] GetFileType (hFile=0x54) returned 0x1 [0063.204] AreFileApisANSI () returned 1 [0063.204] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628da0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0063.205] GetFileType (hFile=0x54) returned 0x1 [0063.206] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe416b720, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe416b720, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc000804, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628770 [0063.206] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe416b720, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe416b720, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc000804, dwReserved1=0x80, cFileName="..", cAlternateFileName="")) returned 1 [0063.206] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe416b720, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe416b720, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe416b720, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0xc000804, dwReserved1=0x80, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0063.206] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe416b720, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe416b720, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe416b720, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0063.206] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe416b720, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe416b720, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe416b720, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0063.207] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610000, dwReserved1=0x628850, cFileName="DW", cAlternateFileName="")) returned 1 [0063.207] AreFileApisANSI () returned 1 [0063.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628de8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68 [0063.208] GetFileType (hFile=0x58) returned 0x1 [0063.210] AreFileApisANSI () returned 1 [0063.210] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628de8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 71 [0063.213] AreFileApisANSI () returned 1 [0063.213] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628de8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68 [0063.215] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe416b720, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe416b720, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628878 [0063.215] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe416b720, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe416b720, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName="..", cAlternateFileName="")) returned 1 [0063.215] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe416b720, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe416b720, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe416b720, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x5000603, dwReserved1=0xca, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0063.215] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe416b720, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe416b720, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe416b720, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6288b0, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0063.215] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe416b720, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe416b720, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe416b720, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6288b0, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0063.215] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x610000, dwReserved1=0x6288b0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0063.215] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x610000, dwReserved1=0x6288b0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0063.215] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x610000, dwReserved1=0x6288b0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0063.215] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x610000, dwReserved1=0x6288b0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 0 [0063.216] FindClose (in: hFindFile=0x628878 | out: hFindFile=0x628878) returned 1 [0063.216] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0063.216] AreFileApisANSI () returned 1 [0063.216] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628de8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0063.218] AreFileApisANSI () returned 1 [0063.218] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628de8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77 [0063.220] AreFileApisANSI () returned 1 [0063.220] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628de8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0063.222] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe4191880, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4191880, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628880 [0063.222] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe4191880, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4191880, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName="..", cAlternateFileName="")) returned 1 [0063.222] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName="1033", cAlternateFileName="")) returned 1 [0063.222] AreFileApisANSI () returned 1 [0063.222] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 79 [0063.223] GetFileType (hFile=0x5c) returned 0x1 [0063.225] AreFileApisANSI () returned 1 [0063.225] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 82 [0063.226] AreFileApisANSI () returned 1 [0063.226] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 79 [0063.230] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe4191880, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4191880, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.230] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe4191880, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4191880, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName="..", cAlternateFileName="")) returned 1 [0063.230] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4191880, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe4191880, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4191880, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x6000402, dwReserved1=0x80, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0063.230] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4191880, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe4191880, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4191880, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628920, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0063.230] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4191880, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe4191880, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4191880, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628910, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0063.230] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x610000, dwReserved1=0x628910, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0063.230] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x610000, dwReserved1=0x628910, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 0 [0063.230] FindClose (in: hFindFile=0x628800 | out: hFindFile=0x628800) returned 1 [0063.230] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4191880, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe4191880, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4191880, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0063.230] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4191880, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe4191880, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4191880, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0063.230] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4191880, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe4191880, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4191880, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0063.231] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0063.231] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0063.231] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="eqnedt32.exe.manifest", cAlternateFileName="EQNEDT~1.MAN")) returned 1 [0063.231] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0063.231] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0063.231] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 0 [0063.231] FindClose (in: hFindFile=0x628880 | out: hFindFile=0x628880) returned 1 [0063.231] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="EURO", cAlternateFileName="")) returned 1 [0063.231] AreFileApisANSI () returned 1 [0063.231] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628de8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0063.233] GetFileType (hFile=0x58) returned 0x1 [0063.234] AreFileApisANSI () returned 1 [0063.234] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628de8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 73 [0063.236] AreFileApisANSI () returned 1 [0063.236] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628de8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0063.239] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe41b79e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe41b79e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628878 [0063.239] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe41b79e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe41b79e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName="..", cAlternateFileName="")) returned 1 [0063.239] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe41b79e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe41b79e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe41b79e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x5000603, dwReserved1=0xca, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0063.239] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe41b79e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe41b79e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe41b79e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6288b0, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0063.239] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe41b79e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe41b79e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe41b79e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6288b0, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0063.239] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x610000, dwReserved1=0x6288b0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0063.240] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x610000, dwReserved1=0x6288b0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 0 [0063.240] FindClose (in: hFindFile=0x628878 | out: hFindFile=0x628878) returned 1 [0063.240] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="Filters", cAlternateFileName="")) returned 1 [0063.240] AreFileApisANSI () returned 1 [0063.240] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628de8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 73 [0063.241] GetFileType (hFile=0x58) returned 0x1 [0063.242] AreFileApisANSI () returned 1 [0063.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628de8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 76 [0063.245] AreFileApisANSI () returned 1 [0063.245] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628de8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 73 [0063.247] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe41b79e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe41b79e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628880 [0063.247] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe41b79e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe41b79e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName="..", cAlternateFileName="")) returned 1 [0063.247] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe41b79e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe41b79e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe41b79e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x5000603, dwReserved1=0xca, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0063.247] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe41b79e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe41b79e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe41ddb40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0063.248] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe41b79e0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe41b79e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe41b79e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0063.248] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0063.248] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0063.248] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0063.248] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0063.248] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0063.248] FindClose (in: hFindFile=0x628880 | out: hFindFile=0x628880) returned 1 [0063.248] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0063.248] AreFileApisANSI () returned 1 [0063.248] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628de8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 73 [0063.252] AreFileApisANSI () returned 1 [0063.252] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628de8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 76 [0063.254] AreFileApisANSI () returned 1 [0063.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628de8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 73 [0063.255] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe41ddb40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe41ddb40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628880 [0063.255] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe41ddb40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe41ddb40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName="..", cAlternateFileName="")) returned 1 [0063.255] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe41ddb40, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe41ddb40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe41ddb40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x5000603, dwReserved1=0xca, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0063.255] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe41ddb40, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe41ddb40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe41ddb40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0063.255] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe41ddb40, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe41ddb40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe41ddb40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0063.256] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0063.256] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1 [0063.256] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1 [0063.256] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1 [0063.256] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1 [0063.256] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1 [0063.256] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="MS.CGM", cAlternateFileName="")) returned 1 [0063.256] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="MS.EPS", cAlternateFileName="")) returned 1 [0063.256] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="MS.GIF", cAlternateFileName="")) returned 1 [0063.256] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="MS.JPG", cAlternateFileName="")) returned 1 [0063.256] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="MS.PNG", cAlternateFileName="")) returned 1 [0063.256] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="MS.WPG", cAlternateFileName="")) returned 1 [0063.256] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1 [0063.256] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1 [0063.256] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1 [0063.256] FindNextFileA (in: hFindFile=0x628880, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x610000, dwReserved1=0x6288b8, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0 [0063.256] FindClose (in: hFindFile=0x628880 | out: hFindFile=0x628880) returned 1 [0063.256] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="Help", cAlternateFileName="")) returned 1 [0063.256] AreFileApisANSI () returned 1 [0063.256] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628de8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0063.257] GetFileType (hFile=0x58) returned 0x1 [0063.259] AreFileApisANSI () returned 1 [0063.259] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628de8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 73 [0063.262] AreFileApisANSI () returned 1 [0063.262] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628de8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0063.264] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe4203ca0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4203ca0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628878 [0063.264] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe4203ca0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4203ca0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName="..", cAlternateFileName="")) returned 1 [0063.264] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe41ddb40, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe41ddb40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe41ddb40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x5000603, dwReserved1=0xca, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0063.264] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4203ca0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe4203ca0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4203ca0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6288b0, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0063.264] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe41ddb40, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe41ddb40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe41ddb40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6288b0, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0063.264] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x610000, dwReserved1=0x6288b0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0063.264] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x610000, dwReserved1=0x6288b0, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0063.264] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x610000, dwReserved1=0x6288b0, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0063.264] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x610000, dwReserved1=0x6288b0, cFileName="msitss55.dll", cAlternateFileName="")) returned 0 [0063.264] FindClose (in: hFindFile=0x628878 | out: hFindFile=0x628878) returned 1 [0063.264] FindNextFileA (in: hFindFile=0x628770, lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="ink", cAlternateFileName="")) returned 1 [0063.265] AreFileApisANSI () returned 1 [0063.265] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628de8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 69 [0063.266] AreFileApisANSI () returned 1 [0063.266] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628de8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 72 [0063.268] AreFileApisANSI () returned 1 [0063.268] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x628de8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 69 [0063.270] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4203ca0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4203ca0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628878 [0063.270] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4203ca0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4203ca0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName="..", cAlternateFileName="")) returned 1 [0063.270] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4203ca0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe4203ca0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4203ca0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x5000603, dwReserved1=0xca, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0063.271] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4203ca0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe4203ca0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4203ca0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6288b0, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0063.271] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4203ca0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe4203ca0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4203ca0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x6288b0, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0063.271] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x610000, dwReserved1=0x6288b0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0063.271] AreFileApisANSI () returned 1 [0063.271] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0063.272] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0063.272] AreFileApisANSI () returned 1 [0063.272] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.273] GetFileType (hFile=0x5c) returned 0x1 [0063.274] AreFileApisANSI () returned 1 [0063.274] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.276] AreFileApisANSI () returned 1 [0063.276] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.279] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4203ca0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4203ca0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.279] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4203ca0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4203ca0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName="..", cAlternateFileName="")) returned 1 [0063.280] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4203ca0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe4203ca0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4203ca0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x6000402, dwReserved1=0x80, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0063.280] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4203ca0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe4203ca0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4229e00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0063.280] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4203ca0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe4203ca0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4203ca0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0063.280] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0063.280] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0063.280] FindClose (in: hFindFile=0x628800 | out: hFindFile=0x628800) returned 1 [0063.280] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0063.280] AreFileApisANSI () returned 1 [0063.280] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.281] GetFileType (hFile=0x5c) returned 0x1 [0063.282] AreFileApisANSI () returned 1 [0063.282] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.284] AreFileApisANSI () returned 1 [0063.284] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.287] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4229e00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4229e00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.288] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4229e00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4229e00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName="..", cAlternateFileName="")) returned 1 [0063.288] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4229e00, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe4229e00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4229e00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x6000402, dwReserved1=0x80, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0063.288] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4229e00, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe4229e00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4229e00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0063.288] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4229e00, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe4229e00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4229e00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0063.288] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0063.288] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0063.288] FindClose (in: hFindFile=0x628800 | out: hFindFile=0x628800) returned 1 [0063.288] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0063.288] AreFileApisANSI () returned 1 [0063.288] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 64 [0063.288] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0063.288] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610000, dwReserved1=0x6288b0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0063.288] AreFileApisANSI () returned 1 [0063.288] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.289] GetFileType (hFile=0x5c) returned 0x1 [0063.290] AreFileApisANSI () returned 1 [0063.290] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.292] AreFileApisANSI () returned 1 [0063.292] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.296] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe424ff60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe424ff60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.296] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe424ff60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe424ff60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName="..", cAlternateFileName="")) returned 1 [0063.296] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4229e00, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe4229e00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4229e00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x6000402, dwReserved1=0x80, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0063.296] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4229e00, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe4229e00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe424ff60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0063.296] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4229e00, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe4229e00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4229e00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0063.296] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0063.296] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0063.296] FindClose (in: hFindFile=0x628800 | out: hFindFile=0x628800) returned 1 [0063.296] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="da-DK", cAlternateFileName="")) returned 1 [0063.296] AreFileApisANSI () returned 1 [0063.296] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.297] GetFileType (hFile=0x5c) returned 0x1 [0063.298] AreFileApisANSI () returned 1 [0063.298] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.300] AreFileApisANSI () returned 1 [0063.300] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.303] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe424ff60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe424ff60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.304] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe424ff60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe424ff60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName="..", cAlternateFileName="")) returned 1 [0063.304] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe424ff60, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe424ff60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe424ff60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x6000402, dwReserved1=0x80, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0063.304] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe424ff60, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe424ff60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe424ff60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0063.304] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe424ff60, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe424ff60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe424ff60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0063.304] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0063.304] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0063.304] FindClose (in: hFindFile=0x628800 | out: hFindFile=0x628800) returned 1 [0063.304] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="de-DE", cAlternateFileName="")) returned 1 [0063.304] AreFileApisANSI () returned 1 [0063.304] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.305] GetFileType (hFile=0x5c) returned 0x1 [0063.308] AreFileApisANSI () returned 1 [0063.308] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.317] AreFileApisANSI () returned 1 [0063.317] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.322] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe42760c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe42760c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.322] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe42760c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe42760c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName="..", cAlternateFileName="")) returned 1 [0063.322] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe424ff60, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe424ff60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe42760c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x6000402, dwReserved1=0x80, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0063.322] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42760c0, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe42760c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe42760c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0063.322] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe424ff60, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe424ff60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe424ff60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0063.322] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0063.323] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0063.323] FindClose (in: hFindFile=0x628800 | out: hFindFile=0x628800) returned 1 [0063.323] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="el-GR", cAlternateFileName="")) returned 1 [0063.323] AreFileApisANSI () returned 1 [0063.323] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.327] GetFileType (hFile=0x5c) returned 0x1 [0063.328] AreFileApisANSI () returned 1 [0063.328] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.329] AreFileApisANSI () returned 1 [0063.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.332] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe429c220, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe429c220, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.333] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe429c220, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe429c220, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName="..", cAlternateFileName="")) returned 1 [0063.333] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe429c220, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe429c220, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe429c220, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x6000402, dwReserved1=0x80, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0063.333] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe429c220, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe429c220, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe429c220, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0063.333] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe429c220, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe429c220, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe429c220, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0063.333] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0063.333] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0063.333] FindClose (in: hFindFile=0x628800 | out: hFindFile=0x628800) returned 1 [0063.333] FindNextFileA (in: hFindFile=0x628878, lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x77163ca3, cFileName="en-US", cAlternateFileName="")) returned 1 [0063.333] AreFileApisANSI () returned 1 [0063.333] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.337] AreFileApisANSI () returned 1 [0063.337] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.338] AreFileApisANSI () returned 1 [0063.338] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.340] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe429c220, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe429c220, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.340] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe429c220, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe429c220, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName="..", cAlternateFileName="")) returned 1 [0063.340] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe429c220, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe429c220, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe429c220, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x6000402, dwReserved1=0x80, cFileName="@@_ATTENTION_@@.txt", cAlternateFileName="@@_ATT~1.TXT")) returned 1 [0063.340] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe429c220, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe429c220, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe429c220, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="@@_HELPER_@@.txt", cAlternateFileName="@@_HEL~1.TXT")) returned 1 [0063.340] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe429c220, ftCreationTime.dwHighDateTime=0x1d531b1, ftLastAccessTime.dwLowDateTime=0xe429c220, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe429c220, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="@@_README_@@.txt", cAlternateFileName="@@_REA~1.TXT")) returned 1 [0063.340] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0063.340] AreFileApisANSI () returned 1 [0063.340] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18cadc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 76 [0063.341] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0063.341] AreFileApisANSI () returned 1 [0063.341] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18cadc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.341] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0063.341] AreFileApisANSI () returned 1 [0063.341] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18cadc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 73 [0063.341] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0063.342] AreFileApisANSI () returned 1 [0063.342] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18cadc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0063.342] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0063.342] AreFileApisANSI () returned 1 [0063.342] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18cadc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0063.342] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0063.342] AreFileApisANSI () returned 1 [0063.342] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18cadc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 69 [0063.342] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0063.342] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x610000, dwReserved1=0x628918, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0063.342] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0063.343] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0063.343] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x610000, dwReserved1=0x628918, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0063.343] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x610000, dwReserved1=0x628918, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0063.343] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x610000, dwReserved1=0x628918, cFileName="join.avi", cAlternateFileName="")) returned 1 [0063.343] AreFileApisANSI () returned 1 [0063.343] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18cadc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 67 [0063.343] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0063.343] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0063.343] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0063.343] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0063.343] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0063.343] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x610000, dwReserved1=0x628918, cFileName="split.avi", cAlternateFileName="")) returned 1 [0063.343] AreFileApisANSI () returned 1 [0063.343] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18cadc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68 [0063.343] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0xfffffffe, dwReserved1=0x7716387a, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0063.343] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0063.343] FindNextFileA (in: hFindFile=0x628800, lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x610000, dwReserved1=0x628908, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0063.343] AreFileApisANSI () returned 1 [0063.343] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.344] GetFileType (hFile=0x5c) returned 0x1 [0063.345] AreFileApisANSI () returned 1 [0063.345] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.347] AreFileApisANSI () returned 1 [0063.347] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.350] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe42c2380, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe42c2380, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.351] AreFileApisANSI () returned 1 [0063.351] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.352] GetFileType (hFile=0x5c) returned 0x1 [0063.353] AreFileApisANSI () returned 1 [0063.353] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.355] AreFileApisANSI () returned 1 [0063.355] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.358] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe42e84e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe42e84e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.359] AreFileApisANSI () returned 1 [0063.359] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.359] GetFileType (hFile=0x5c) returned 0x1 [0063.360] AreFileApisANSI () returned 1 [0063.360] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.362] AreFileApisANSI () returned 1 [0063.362] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.365] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe42e84e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe42e84e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.365] AreFileApisANSI () returned 1 [0063.365] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 71 [0063.366] AreFileApisANSI () returned 1 [0063.366] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.366] GetFileType (hFile=0x5c) returned 0x1 [0063.367] AreFileApisANSI () returned 1 [0063.368] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.369] AreFileApisANSI () returned 1 [0063.369] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.372] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe42e84e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe42e84e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.373] AreFileApisANSI () returned 1 [0063.373] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355e8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0063.376] AreFileApisANSI () returned 1 [0063.376] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355e8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 86 [0063.377] AreFileApisANSI () returned 1 [0063.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355e8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0063.379] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe430e640, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe430e640, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.379] AreFileApisANSI () returned 1 [0063.379] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x635b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 90 [0063.380] GetFileType (hFile=0x60) returned 0x1 [0063.381] AreFileApisANSI () returned 1 [0063.381] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x635b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 93 [0063.383] AreFileApisANSI () returned 1 [0063.383] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x635b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 90 [0063.386] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe430e640, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe430e640, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb3, cFileName=".", cAlternateFileName="")) returned 0x628958 [0063.386] AreFileApisANSI () returned 1 [0063.386] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 85 [0063.387] AreFileApisANSI () returned 1 [0063.387] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18cadc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77 [0063.387] AreFileApisANSI () returned 1 [0063.387] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x635b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 90 [0063.388] GetFileType (hFile=0x60) returned 0x1 [0063.389] AreFileApisANSI () returned 1 [0063.389] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x635b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 93 [0063.392] AreFileApisANSI () returned 1 [0063.392] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x635b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 90 [0063.394] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe43347a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe43347a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb3, cFileName=".", cAlternateFileName="")) returned 0x628958 [0063.394] AreFileApisANSI () returned 1 [0063.394] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 80 [0063.394] AreFileApisANSI () returned 1 [0063.394] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0063.395] AreFileApisANSI () returned 1 [0063.395] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 85 [0063.395] AreFileApisANSI () returned 1 [0063.395] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18cadc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77 [0063.395] AreFileApisANSI () returned 1 [0063.395] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x635b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0063.398] AreFileApisANSI () returned 1 [0063.398] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x635b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 91 [0063.400] AreFileApisANSI () returned 1 [0063.400] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x635b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0063.401] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe43347a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe43347a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb3, cFileName=".", cAlternateFileName="")) returned 0x628958 [0063.402] AreFileApisANSI () returned 1 [0063.402] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 80 [0063.402] AreFileApisANSI () returned 1 [0063.402] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 89 [0063.402] AreFileApisANSI () returned 1 [0063.402] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 86 [0063.403] AreFileApisANSI () returned 1 [0063.403] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0063.403] AreFileApisANSI () returned 1 [0063.403] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0063.404] AreFileApisANSI () returned 1 [0063.404] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0063.404] AreFileApisANSI () returned 1 [0063.404] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0063.404] AreFileApisANSI () returned 1 [0063.404] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84 [0063.404] AreFileApisANSI () returned 1 [0063.405] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0063.405] AreFileApisANSI () returned 1 [0063.405] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0063.405] AreFileApisANSI () returned 1 [0063.405] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0063.406] AreFileApisANSI () returned 1 [0063.406] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0063.406] AreFileApisANSI () returned 1 [0063.406] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0063.406] AreFileApisANSI () returned 1 [0063.406] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18cadc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.407] AreFileApisANSI () returned 1 [0063.407] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x635b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 91 [0063.407] GetFileType (hFile=0x60) returned 0x1 [0063.408] AreFileApisANSI () returned 1 [0063.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x635b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 94 [0063.410] AreFileApisANSI () returned 1 [0063.410] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x635b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 91 [0063.412] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe435a900, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe435a900, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb3, cFileName=".", cAlternateFileName="")) returned 0x628958 [0063.413] AreFileApisANSI () returned 1 [0063.413] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 86 [0063.413] AreFileApisANSI () returned 1 [0063.413] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18cadc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.414] AreFileApisANSI () returned 1 [0063.414] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x635b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 91 [0063.415] GetFileType (hFile=0x60) returned 0x1 [0063.417] AreFileApisANSI () returned 1 [0063.417] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x635b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 94 [0063.418] AreFileApisANSI () returned 1 [0063.418] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x635b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 91 [0063.421] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4380a60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4380a60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb3, cFileName=".", cAlternateFileName="")) returned 0x628958 [0063.421] AreFileApisANSI () returned 1 [0063.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 90 [0063.422] AreFileApisANSI () returned 1 [0063.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18cadc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.422] AreFileApisANSI () returned 1 [0063.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x635b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 93 [0063.423] GetFileType (hFile=0x60) returned 0x1 [0063.424] AreFileApisANSI () returned 1 [0063.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x635b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 96 [0063.427] AreFileApisANSI () returned 1 [0063.427] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x635b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 93 [0063.430] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4380a60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4380a60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb3, cFileName=".", cAlternateFileName="")) returned 0x628960 [0063.430] AreFileApisANSI () returned 1 [0063.430] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 94 [0063.430] AreFileApisANSI () returned 1 [0063.430] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18cadc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 80 [0063.431] AreFileApisANSI () returned 1 [0063.431] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x635b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 91 [0063.432] GetFileType (hFile=0x60) returned 0x1 [0063.433] AreFileApisANSI () returned 1 [0063.433] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x635b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 94 [0063.435] AreFileApisANSI () returned 1 [0063.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x635b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 91 [0063.536] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe448b400, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe448b400, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb3, cFileName=".", cAlternateFileName="")) returned 0x628958 [0063.536] AreFileApisANSI () returned 1 [0063.536] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 90 [0063.545] AreFileApisANSI () returned 1 [0063.545] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18cadc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.545] AreFileApisANSI () returned 1 [0063.545] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x635b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 91 [0063.545] GetFileType (hFile=0x60) returned 0x1 [0063.546] AreFileApisANSI () returned 1 [0063.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x635b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 94 [0063.549] AreFileApisANSI () returned 1 [0063.549] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x635b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 91 [0063.550] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe44b1560, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe44b1560, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb3, cFileName=".", cAlternateFileName="")) returned 0x628958 [0063.550] AreFileApisANSI () returned 1 [0063.550] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 85 [0063.550] AreFileApisANSI () returned 1 [0063.550] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0063.551] AreFileApisANSI () returned 1 [0063.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 86 [0063.551] AreFileApisANSI () returned 1 [0063.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18cadc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.552] AreFileApisANSI () returned 1 [0063.552] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x635b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0063.553] GetFileType (hFile=0x60) returned 0x1 [0063.554] AreFileApisANSI () returned 1 [0063.554] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x635b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 90 [0063.555] AreFileApisANSI () returned 1 [0063.555] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x635b40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0063.557] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe44b1560, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe44b1560, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb3, cFileName=".", cAlternateFileName="")) returned 0x628950 [0063.557] AreFileApisANSI () returned 1 [0063.557] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c178, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 82 [0063.558] AreFileApisANSI () returned 1 [0063.558] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18cadc, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0063.558] AreFileApisANSI () returned 1 [0063.558] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.558] GetFileType (hFile=0x5c) returned 0x1 [0063.559] AreFileApisANSI () returned 1 [0063.559] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.561] AreFileApisANSI () returned 1 [0063.561] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.563] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe44d76c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe44d76c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.564] AreFileApisANSI () returned 1 [0063.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.564] GetFileType (hFile=0x5c) returned 0x1 [0063.565] AreFileApisANSI () returned 1 [0063.565] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.566] AreFileApisANSI () returned 1 [0063.566] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.569] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe44d76c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe44d76c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.569] AreFileApisANSI () returned 1 [0063.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.569] GetFileType (hFile=0x5c) returned 0x1 [0063.570] AreFileApisANSI () returned 1 [0063.570] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.571] AreFileApisANSI () returned 1 [0063.572] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.574] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe44d76c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe44d76c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.574] AreFileApisANSI () returned 1 [0063.574] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68 [0063.574] AreFileApisANSI () returned 1 [0063.574] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355e8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 86 [0063.576] GetFileType (hFile=0x5c) returned 0x1 [0063.577] AreFileApisANSI () returned 1 [0063.577] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355e8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 89 [0063.578] AreFileApisANSI () returned 1 [0063.578] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355e8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 86 [0063.581] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe44fd820, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe44fd820, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.581] AreFileApisANSI () returned 1 [0063.581] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0063.582] AreFileApisANSI () returned 1 [0063.582] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0063.582] AreFileApisANSI () returned 1 [0063.582] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 67 [0063.582] AreFileApisANSI () returned 1 [0063.582] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 64 [0063.583] AreFileApisANSI () returned 1 [0063.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 64 [0063.583] AreFileApisANSI () returned 1 [0063.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0063.583] AreFileApisANSI () returned 1 [0063.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0063.583] AreFileApisANSI () returned 1 [0063.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0063.583] AreFileApisANSI () returned 1 [0063.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0063.583] AreFileApisANSI () returned 1 [0063.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0063.584] AreFileApisANSI () returned 1 [0063.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0063.584] AreFileApisANSI () returned 1 [0063.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0063.584] AreFileApisANSI () returned 1 [0063.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0063.584] AreFileApisANSI () returned 1 [0063.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 62 [0063.585] AreFileApisANSI () returned 1 [0063.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0063.585] AreFileApisANSI () returned 1 [0063.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0063.585] AreFileApisANSI () returned 1 [0063.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0063.586] AreFileApisANSI () returned 1 [0063.586] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0063.586] AreFileApisANSI () returned 1 [0063.586] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0063.586] AreFileApisANSI () returned 1 [0063.586] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0063.586] AreFileApisANSI () returned 1 [0063.586] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0063.587] AreFileApisANSI () returned 1 [0063.587] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0063.587] AreFileApisANSI () returned 1 [0063.587] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0063.587] AreFileApisANSI () returned 1 [0063.587] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0063.588] AreFileApisANSI () returned 1 [0063.588] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0063.588] AreFileApisANSI () returned 1 [0063.588] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0063.588] AreFileApisANSI () returned 1 [0063.588] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0063.588] AreFileApisANSI () returned 1 [0063.588] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0063.588] AreFileApisANSI () returned 1 [0063.588] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0063.588] AreFileApisANSI () returned 1 [0063.588] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0063.589] AreFileApisANSI () returned 1 [0063.589] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18d440, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0063.589] AreFileApisANSI () returned 1 [0063.589] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.589] GetFileType (hFile=0x5c) returned 0x1 [0063.590] AreFileApisANSI () returned 1 [0063.590] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.591] AreFileApisANSI () returned 1 [0063.591] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.593] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4523980, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4523980, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.594] AreFileApisANSI () returned 1 [0063.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.596] GetFileType (hFile=0x5c) returned 0x1 [0063.597] AreFileApisANSI () returned 1 [0063.597] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.598] AreFileApisANSI () returned 1 [0063.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.600] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4523980, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4523980, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.601] AreFileApisANSI () returned 1 [0063.601] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.601] GetFileType (hFile=0x5c) returned 0x1 [0063.602] AreFileApisANSI () returned 1 [0063.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.603] AreFileApisANSI () returned 1 [0063.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.606] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4523980, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4523980, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.606] AreFileApisANSI () returned 1 [0063.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.607] GetFileType (hFile=0x5c) returned 0x1 [0063.608] AreFileApisANSI () returned 1 [0063.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.609] AreFileApisANSI () returned 1 [0063.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.611] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4549ae0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4549ae0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.612] AreFileApisANSI () returned 1 [0063.612] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.612] GetFileType (hFile=0x5c) returned 0x1 [0063.613] AreFileApisANSI () returned 1 [0063.613] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.614] AreFileApisANSI () returned 1 [0063.614] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.616] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4549ae0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4549ae0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.617] AreFileApisANSI () returned 1 [0063.617] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.617] GetFileType (hFile=0x5c) returned 0x1 [0063.618] AreFileApisANSI () returned 1 [0063.618] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.619] AreFileApisANSI () returned 1 [0063.619] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.622] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4549ae0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4549ae0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.622] AreFileApisANSI () returned 1 [0063.622] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.623] GetFileType (hFile=0x5c) returned 0x1 [0063.623] AreFileApisANSI () returned 1 [0063.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.625] AreFileApisANSI () returned 1 [0063.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.627] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe456fc40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe456fc40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.627] AreFileApisANSI () returned 1 [0063.627] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75 [0063.628] GetFileType (hFile=0x5c) returned 0x1 [0063.629] AreFileApisANSI () returned 1 [0063.629] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6355d8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0063.635] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe456fc40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe456fc40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.635] GetFileType (hFile=0x5c) returned 0x1 [0063.640] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4595da0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4595da0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.640] GetFileType (hFile=0x5c) returned 0x1 [0063.645] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4595da0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4595da0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.645] GetFileType (hFile=0x5c) returned 0x1 [0063.687] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe46081c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe46081c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.688] GetFileType (hFile=0x5c) returned 0x1 [0063.692] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe46081c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe46081c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.693] GetFileType (hFile=0x5c) returned 0x1 [0063.698] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe46081c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe46081c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.698] GetFileType (hFile=0x5c) returned 0x1 [0063.703] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe462e320, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe462e320, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.704] GetFileType (hFile=0x5c) returned 0x1 [0063.708] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe462e320, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe462e320, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.709] GetFileType (hFile=0x5c) returned 0x1 [0063.714] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe462e320, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe462e320, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.715] GetFileType (hFile=0x5c) returned 0x1 [0063.721] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4654480, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4654480, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.722] GetFileType (hFile=0x5c) returned 0x1 [0063.726] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4654480, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4654480, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.727] GetFileType (hFile=0x5c) returned 0x1 [0063.735] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe467a5e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe467a5e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.736] GetFileType (hFile=0x5c) returned 0x1 [0063.740] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe467a5e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe467a5e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.741] GetFileType (hFile=0x5c) returned 0x1 [0063.745] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe467a5e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe467a5e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.747] GetFileType (hFile=0x58) returned 0x1 [0063.751] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe46a0740, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe46a0740, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628890 [0063.752] GetFileType (hFile=0x58) returned 0x1 [0063.757] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe46a0740, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe46a0740, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628880 [0063.758] GetFileType (hFile=0x5c) returned 0x1 [0063.766] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe46c68a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe46c68a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.772] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe46c68a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe46c68a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628880 [0063.776] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe46c68a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe46c68a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.777] GetFileType (hFile=0x5c) returned 0x1 [0063.783] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xe46eca00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe46eca00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.788] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe46eca00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe46eca00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.794] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4712b60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4712b60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb2, cFileName=".", cAlternateFileName="")) returned 0x628840 [0063.796] GetFileType (hFile=0x60) returned 0x1 [0063.801] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe4712b60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4712b60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb2, cFileName=".", cAlternateFileName="")) returned 0x628840 [0063.807] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe4712b60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4712b60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb2, cFileName=".", cAlternateFileName="")) returned 0x628840 [0063.812] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4738cc0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4738cc0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb2, cFileName=".", cAlternateFileName="")) returned 0x628840 [0063.816] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe4738cc0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4738cc0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb2, cFileName=".", cAlternateFileName="")) returned 0x628840 [0063.821] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4738cc0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4738cc0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb2, cFileName=".", cAlternateFileName="")) returned 0x628840 [0063.825] GetFileType (hFile=0x60) returned 0x1 [0063.834] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe475ee20, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe475ee20, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb2, cFileName=".", cAlternateFileName="")) returned 0x628840 [0063.843] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4784f80, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4784f80, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb2, cFileName=".", cAlternateFileName="")) returned 0x628840 [0063.853] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4784f80, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4784f80, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb2, cFileName=".", cAlternateFileName="")) returned 0x628840 [0063.859] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe47ab0e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe47ab0e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb2, cFileName=".", cAlternateFileName="")) returned 0x628840 [0063.860] GetFileType (hFile=0x60) returned 0x1 [0063.864] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xe47ab0e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe47ab0e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb2, cFileName=".", cAlternateFileName="")) returned 0x628840 [0063.871] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xe47ab0e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe47ab0e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb2, cFileName=".", cAlternateFileName="")) returned 0x628840 [0063.872] GetFileType (hFile=0x60) returned 0x1 [0063.877] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe47d1240, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe47d1240, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb2, cFileName=".", cAlternateFileName="")) returned 0x628840 [0063.878] GetFileType (hFile=0x60) returned 0x1 [0063.883] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe47d1240, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe47d1240, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb2, cFileName=".", cAlternateFileName="")) returned 0x628840 [0063.886] GetFileType (hFile=0x60) returned 0x1 [0063.890] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe47f73a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe47f73a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb2, cFileName=".", cAlternateFileName="")) returned 0x628840 [0063.890] GetFileType (hFile=0x60) returned 0x1 [0063.895] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe47f73a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe47f73a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb2, cFileName=".", cAlternateFileName="")) returned 0x628840 [0063.896] GetFileType (hFile=0x60) returned 0x1 [0063.900] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe47f73a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe47f73a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb2, cFileName=".", cAlternateFileName="")) returned 0x628840 [0063.905] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe481d500, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe481d500, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb2, cFileName=".", cAlternateFileName="")) returned 0x628840 [0063.907] GetFileType (hFile=0x60) returned 0x1 [0063.911] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xe481d500, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe481d500, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb2, cFileName=".", cAlternateFileName="")) returned 0x628840 [0063.912] GetFileType (hFile=0x60) returned 0x1 [0063.917] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xe481d500, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe481d500, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb2, cFileName=".", cAlternateFileName="")) returned 0x628840 [0063.919] GetFileType (hFile=0x60) returned 0x1 [0063.923] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4843660, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4843660, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb2, cFileName=".", cAlternateFileName="")) returned 0x628840 [0063.927] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4843660, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4843660, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x6288b0 [0063.929] GetFileType (hFile=0x58) returned 0x1 [0063.934] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4843660, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4843660, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628878 [0063.938] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe48697c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe48697c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628880 [0063.939] GetFileType (hFile=0x5c) returned 0x1 [0063.944] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe48697c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe48697c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.946] GetFileType (hFile=0x5c) returned 0x1 [0063.950] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe488f920, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe488f920, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.956] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe488f920, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe488f920, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb2, cFileName=".", cAlternateFileName="")) returned 0x628840 [0063.958] GetFileType (hFile=0x58) returned 0x1 [0063.964] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe488f920, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe488f920, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628888 [0063.969] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe48b5a80, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe48b5a80, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628888 [0063.985] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe48dbbe0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe48dbbe0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628880 [0063.986] GetFileType (hFile=0x5c) returned 0x1 [0063.990] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe48dbbe0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe48dbbe0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0063.995] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe48dbbe0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe48dbbe0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628880 [0063.996] GetFileType (hFile=0x5c) returned 0x1 [0064.001] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4901d40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4901d40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.003] GetFileType (hFile=0x5c) returned 0x1 [0064.008] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4901d40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4901d40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.009] GetFileType (hFile=0x5c) returned 0x1 [0064.013] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4927ea0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4927ea0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.014] GetFileType (hFile=0x5c) returned 0x1 [0064.019] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4927ea0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4927ea0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.019] GetFileType (hFile=0x5c) returned 0x1 [0064.023] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4927ea0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4927ea0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.024] GetFileType (hFile=0x5c) returned 0x1 [0064.039] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe494e000, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe494e000, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.040] GetFileType (hFile=0x5c) returned 0x1 [0064.045] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4974160, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4974160, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.046] GetFileType (hFile=0x5c) returned 0x1 [0064.050] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4974160, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4974160, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.051] GetFileType (hFile=0x5c) returned 0x1 [0064.057] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4974160, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4974160, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.058] GetFileType (hFile=0x5c) returned 0x1 [0064.062] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe499a2c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe499a2c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.063] GetFileType (hFile=0x5c) returned 0x1 [0064.068] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe499a2c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe499a2c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.070] GetFileType (hFile=0x5c) returned 0x1 [0064.074] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe499a2c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe499a2c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.074] GetFileType (hFile=0x5c) returned 0x1 [0064.079] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe49c0420, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe49c0420, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.081] GetFileType (hFile=0x5c) returned 0x1 [0064.086] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe49c0420, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe49c0420, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.087] GetFileType (hFile=0x5c) returned 0x1 [0064.091] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe49e6580, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe49e6580, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.092] GetFileType (hFile=0x5c) returned 0x1 [0064.096] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe49e6580, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe49e6580, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.097] GetFileType (hFile=0x5c) returned 0x1 [0064.101] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe49e6580, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe49e6580, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.102] GetFileType (hFile=0x5c) returned 0x1 [0064.107] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4a0c6e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4a0c6e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.108] GetFileType (hFile=0x5c) returned 0x1 [0064.112] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4a0c6e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4a0c6e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.113] GetFileType (hFile=0x5c) returned 0x1 [0064.117] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4a0c6e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4a0c6e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.119] GetFileType (hFile=0x5c) returned 0x1 [0064.123] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4a32840, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4a32840, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.124] GetFileType (hFile=0x5c) returned 0x1 [0064.128] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4a32840, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4a32840, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.129] GetFileType (hFile=0x5c) returned 0x1 [0064.133] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4a32840, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4a32840, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.134] GetFileType (hFile=0x5c) returned 0x1 [0064.138] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4a589a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4a589a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.146] GetFileType (hFile=0x5c) returned 0x1 [0064.165] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4a7eb00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4a7eb00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.166] GetFileType (hFile=0x5c) returned 0x1 [0064.175] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4aa4c60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4aa4c60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.176] GetFileType (hFile=0x5c) returned 0x1 [0064.180] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4aa4c60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4aa4c60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.180] GetFileType (hFile=0x5c) returned 0x1 [0064.184] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4acadc0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4acadc0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.186] GetFileType (hFile=0x5c) returned 0x1 [0064.191] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4acadc0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4acadc0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.192] GetFileType (hFile=0x5c) returned 0x1 [0064.197] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4acadc0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4acadc0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.199] GetFileType (hFile=0x5c) returned 0x1 [0064.204] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4af0f20, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4af0f20, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.204] GetFileType (hFile=0x5c) returned 0x1 [0064.237] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4b3d1e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4b3d1e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.238] GetFileType (hFile=0x5c) returned 0x1 [0064.243] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4b3d1e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4b3d1e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.243] GetFileType (hFile=0x5c) returned 0x1 [0064.250] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4b63340, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4b63340, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.251] GetFileType (hFile=0x5c) returned 0x1 [0064.255] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4b63340, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4b63340, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.256] GetFileType (hFile=0x5c) returned 0x1 [0064.260] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4b63340, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4b63340, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.261] GetFileType (hFile=0x5c) returned 0x1 [0064.265] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4b894a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4b894a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.266] GetFileType (hFile=0x5c) returned 0x1 [0064.270] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4b894a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4b894a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.271] GetFileType (hFile=0x5c) returned 0x1 [0064.275] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4b894a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4b894a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.276] GetFileType (hFile=0x5c) returned 0x1 [0064.281] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4baf600, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4baf600, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.284] GetFileType (hFile=0x5c) returned 0x1 [0064.288] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4baf600, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4baf600, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.289] GetFileType (hFile=0x5c) returned 0x1 [0064.293] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4bd5760, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4bd5760, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.294] GetFileType (hFile=0x5c) returned 0x1 [0064.298] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4bd5760, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4bd5760, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.299] GetFileType (hFile=0x5c) returned 0x1 [0064.303] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4bd5760, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4bd5760, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.304] GetFileType (hFile=0x5c) returned 0x1 [0064.308] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4bd5760, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4bd5760, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.320] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4bfb8c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4bfb8c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628880 [0064.321] GetFileType (hFile=0x5c) returned 0x1 [0064.326] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4c21a20, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4c21a20, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.327] GetFileType (hFile=0x5c) returned 0x1 [0064.332] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4c21a20, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4c21a20, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.333] GetFileType (hFile=0x5c) returned 0x1 [0064.337] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4c21a20, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4c21a20, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.337] GetFileType (hFile=0x5c) returned 0x1 [0064.342] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4c47b80, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4c47b80, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.343] GetFileType (hFile=0x5c) returned 0x1 [0064.347] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4c47b80, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4c47b80, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.348] GetFileType (hFile=0x5c) returned 0x1 [0064.353] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4c47b80, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4c47b80, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.353] GetFileType (hFile=0x58) returned 0x1 [0064.357] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe4c6dce0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4c6dce0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628880 [0064.358] GetFileType (hFile=0x5c) returned 0x1 [0064.363] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe4c6dce0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4c6dce0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.364] GetFileType (hFile=0x58) returned 0x1 [0064.368] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe4c6dce0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4c6dce0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628878 [0064.369] GetFileType (hFile=0x5c) returned 0x1 [0064.375] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe4c93e40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4c93e40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.382] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe4c93e40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4c93e40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb3, cFileName=".", cAlternateFileName="")) returned 0x628940 [0064.383] GetFileType (hFile=0x58) returned 0x1 [0064.387] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\VC\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xe4cb9fa0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4cb9fa0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628878 [0064.388] GetFileType (hFile=0x58) returned 0x1 [0064.392] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe4cb9fa0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4cb9fa0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628878 [0064.397] GetFileType (hFile=0x58) returned 0x1 [0064.401] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xe4cb9fa0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4cb9fa0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628888 [0064.407] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xe4ce0100, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4ce0100, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.414] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xe4ce0100, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4ce0100, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628878 [0064.419] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xe4d06260, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4d06260, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.429] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4d06260, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4d06260, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0xb3, cFileName=".", cAlternateFileName="")) returned 0x628948 [0064.431] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c29c | out: lpNewFilePointer=0x0) returned 1 [0064.431] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c250 | out: lpNewFilePointer=0x0) returned 1 [0064.431] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c284 | out: lpNewFilePointer=0x0) returned 1 [0064.431] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.431] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.431] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c284 | out: lpNewFilePointer=0x0) returned 1 [0064.431] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.431] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.434] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.434] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.434] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.434] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.434] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.434] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.434] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.434] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.434] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x8, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.434] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.434] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.434] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.435] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.435] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.435] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.435] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.435] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x10, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.435] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.435] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.435] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.435] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x18, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.435] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.435] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.435] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.435] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x18, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.435] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.435] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.436] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.436] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x20, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.436] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.436] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.436] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.436] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x20, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.436] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.436] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.436] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.436] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x28, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.436] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.436] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.436] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.436] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x28, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.437] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.437] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.437] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.437] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x30, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.437] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.437] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.437] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.437] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x30, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.437] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.437] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.437] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.437] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x38, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.437] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.437] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.438] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.438] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x38, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.438] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.438] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.438] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.438] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x40, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.438] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.438] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.438] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.438] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x40, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.438] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.438] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.438] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.438] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x48, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.439] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.439] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.439] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.439] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x48, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.439] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.439] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.439] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.439] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x50, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.439] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.439] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.439] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.439] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x50, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.439] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.439] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.440] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.440] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x58, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.440] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.440] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.440] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.440] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x58, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.440] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.440] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.440] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.440] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x60, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.440] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.440] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.440] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.440] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x60, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.440] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.441] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.441] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.441] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x68, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.441] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.441] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.441] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.441] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x68, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.441] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.441] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.441] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.441] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x70, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.441] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.441] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.441] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.442] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x70, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.442] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.442] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.442] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.442] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x78, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.442] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.442] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.442] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.442] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x78, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.442] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.442] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.442] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.442] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x80, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.442] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.443] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.443] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.443] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x80, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.443] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.443] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.443] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.443] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x88, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.443] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.443] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.443] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.443] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x88, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.443] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.443] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.443] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.444] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x90, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.444] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.444] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.444] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.444] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x90, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.444] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.444] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.444] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.444] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x98, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.444] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.444] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.444] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.444] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x98, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.444] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.444] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.445] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.445] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0xa0, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.445] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.445] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.445] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.445] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0xa0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.445] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.445] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.445] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.445] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0xa8, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.445] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.445] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.445] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.445] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0xa8, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.445] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.446] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.446] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.446] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.446] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.446] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.446] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.446] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0xb0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.446] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.446] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.446] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.446] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0xb8, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.446] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.446] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.446] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.447] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0xb8, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.447] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.447] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.447] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.447] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0xc0, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.447] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.447] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.447] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.447] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0xc0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.447] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.447] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.447] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.447] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0xc8, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.447] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.448] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.448] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.448] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0xc8, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.448] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.448] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.448] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.448] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0xd0, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.448] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.448] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.448] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.448] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0xd0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.448] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.448] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.448] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.449] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0xd8, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.449] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.449] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.449] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.449] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0xd8, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.449] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.449] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.449] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.449] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0xe0, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.449] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.449] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.449] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.449] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0xe0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.449] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.449] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.450] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.450] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0xe8, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.450] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.450] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.450] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.450] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0xe8, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.450] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2a4 | out: lpNewFilePointer=0x0) returned 1 [0064.450] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c26c | out: lpNewFilePointer=0x0) returned 1 [0064.450] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c200 | out: lpNewFilePointer=0x0) returned 1 [0064.450] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0xf0, lpNewFilePointer=0x0, dwMoveMethod=0x18c27c | out: lpNewFilePointer=0x0) returned 1 [0064.450] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c230 | out: lpNewFilePointer=0x0) returned 1 [0064.450] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2e0 | out: lpNewFilePointer=0x0) returned 1 [0064.450] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c274 | out: lpNewFilePointer=0x0) returned 1 [0064.450] SetFilePointerEx (in: hFile=0x60, liDistanceToMove=0xf0, lpNewFilePointer=0x0, dwMoveMethod=0x18c2f0 | out: lpNewFilePointer=0x0) returned 1 [0064.451] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), lpNewFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.isolated" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.isolated"), dwFlags=0x2) returned 1 [0064.453] GetFileType (hFile=0x58) returned 0x1 [0064.457] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe4d52520, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4d52520, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628888 [0064.458] GetFileType (hFile=0x5c) returned 0x1 [0064.462] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe4d52520, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4d52520, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.464] GetFileType (hFile=0x58) returned 0x1 [0064.468] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe4d78680, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4d78680, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5000603, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628898 [0064.469] GetFileType (hFile=0x5c) returned 0x1 [0064.473] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe4d78680, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4d78680, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6000402, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.474] GetFileType (hFile=0x60) returned 0x1 [0064.479] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe4d78680, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4d78680, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000201, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628840 [0064.479] GetFileType (hFile=0x64) returned 0x1 [0064.484] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe4d9e7e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4d9e7e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa40004a0, dwReserved1=0xaf, cFileName=".", cAlternateFileName="")) returned 0x628988 [0064.485] GetFileType (hFile=0x54) returned 0x1 [0064.490] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4d9e7e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4d9e7e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628770 [0064.491] GetFileType (hFile=0x54) returned 0x1 [0064.500] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\SpeechEngines\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4dc4940, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4dc4940, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628770 [0064.502] GetFileType (hFile=0x58) returned 0x1 [0064.506] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4dc4940, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4dc4940, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628880 [0064.507] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x180, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.507] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x180, dwReserved1=0xb2, cFileName=".", cAlternateFileName="")) returned 0x628840 [0064.507] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x180, dwReserved1=0xb2, cFileName=".", cAlternateFileName="")) returned 0x628968 [0064.513] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\System\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4deaaa0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4deaaa0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628770 [0064.517] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4deaaa0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4deaaa0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628860 [0064.522] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe4deaaa0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4deaaa0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.527] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe4e10c00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4e10c00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628868 [0064.532] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4e10c00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4e10c00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628868 [0064.537] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe4e10c00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4e10c00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.542] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\System\\MSMAPI\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4e10c00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4e10c00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628868 [0064.547] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe4e36d60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4e36d60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xb5, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.552] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe4e36d60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4e36d60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xca, cFileName=".", cAlternateFileName="")) returned 0x628868 [0064.556] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe4e36d60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4e36d60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xb5, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.560] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\DVD Maker\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe4e5cec0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4e5cec0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x628770 [0064.564] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\DVD Maker\\en-US\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe4e5cec0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4e5cec0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xd4, cFileName=".", cAlternateFileName="")) returned 0x628800 [0064.569] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\DVD Maker\\Shared\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe4e5cec0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4e5cec0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xd4, cFileName=".", cAlternateFileName="")) returned 0x628808 [0064.577] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe4e83020, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4e83020, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x6287b0 [0064.584] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe4e83020, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4e83020, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6288c0 [0064.594] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe4ea9180, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4ea9180, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6288c0 [0064.604] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe4ea9180, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4ea9180, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6288c0 [0064.622] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe4ef5440, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4ef5440, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6288b8 [0064.633] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe4ef5440, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4ef5440, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6288c0 [0064.642] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe4f1b5a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4f1b5a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6288d0 [0064.651] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe4f1b5a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4f1b5a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6288c0 [0064.660] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe4f41700, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4f41700, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6288c0 [0064.666] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe4f41700, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4f41700, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6288c8 [0064.675] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe4f67860, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4f67860, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6288b8 [0064.684] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe4f8d9c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4f8d9c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x628848 [0064.689] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe4f8d9c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4f8d9c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6288c8 [0064.696] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe4f8d9c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4f8d9c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6288d0 [0064.703] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe4fb3b20, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4fb3b20, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6288c0 [0064.707] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe4fb3b20, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4fb3b20, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6288d0 [0064.714] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe4fd9c80, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4fd9c80, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6288c0 [0064.723] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe4fd9c80, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4fd9c80, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6288c0 [0064.729] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe4fd9c80, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4fd9c80, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6288c0 [0064.737] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe4fffde0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4fffde0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6288c8 [0064.742] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xe4fffde0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe4fffde0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6288c0 [0064.745] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Internet Explorer\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe5025f40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe5025f40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287c8 [0064.749] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe5025f40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe5025f40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628770 [0064.755] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe5025f40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe5025f40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628770 [0064.760] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Analysis Services\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5025f40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe5025f40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287d8 [0064.764] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe504c0a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe504c0a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc7, cFileName=".", cAlternateFileName="")) returned 0x628770 [0064.772] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe504c0a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe504c0a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc7, cFileName=".", cAlternateFileName="")) returned 0x628898 [0064.776] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5072200, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe5072200, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628818 [0064.781] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5072200, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe5072200, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628818 [0064.786] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5072200, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe5072200, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xaf, cFileName=".", cAlternateFileName="")) returned 0x628858 [0064.786] GetFileType (hFile=0x50) returned 0x1 [0064.787] GetFileType (hFile=0x50) returned 0x1 [0064.789] GetFileType (hFile=0x50) returned 0x1 [0064.790] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\*", lpFindFileData=0x18e1c8 | out: lpFindFileData=0x18e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5072200, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe5072200, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x6287c8 [0064.795] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\CLIPART\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5098360, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe5098360, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628770 [0064.801] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5098360, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe5098360, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x628880 [0064.848] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe510a780, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe510a780, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x628880 [0064.853] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe510a780, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe510a780, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xb2, cFileName=".", cAlternateFileName="")) returned 0x628808 [0064.858] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe51308e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe51308e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x628770 [0064.864] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe51308e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe51308e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6288a0 [0064.868] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml.isolated"), dwFlags=0x2) returned 1 [0064.870] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml.isolated"), dwFlags=0x2) returned 1 [0064.874] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml.isolated"), dwFlags=0x2) returned 1 [0064.878] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml.isolated"), dwFlags=0x2) returned 1 [0064.881] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml.isolated"), dwFlags=0x2) returned 1 [0064.884] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml.isolated"), dwFlags=0x2) returned 1 [0064.887] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml.isolated"), dwFlags=0x2) returned 1 [0064.890] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml.isolated"), dwFlags=0x2) returned 1 [0064.893] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml.isolated"), dwFlags=0x2) returned 1 [0064.896] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml.isolated"), dwFlags=0x2) returned 1 [0064.899] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml.isolated"), dwFlags=0x2) returned 1 [0064.904] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml.isolated"), dwFlags=0x2) returned 1 [0064.907] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml.isolated"), dwFlags=0x2) returned 1 [0064.910] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml.isolated"), dwFlags=0x2) returned 1 [0064.914] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml.isolated"), dwFlags=0x2) returned 1 [0064.917] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml.isolated"), dwFlags=0x2) returned 1 [0064.920] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml.isolated"), dwFlags=0x2) returned 1 [0064.923] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml.isolated"), dwFlags=0x2) returned 1 [0064.926] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml.isolated"), dwFlags=0x2) returned 1 [0064.929] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml.isolated"), dwFlags=0x2) returned 1 [0064.933] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml.isolated"), dwFlags=0x2) returned 1 [0064.936] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml.isolated"), dwFlags=0x2) returned 1 [0064.939] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml.isolated"), dwFlags=0x2) returned 1 [0064.942] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml.isolated"), dwFlags=0x2) returned 1 [0064.945] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml.isolated"), dwFlags=0x2) returned 1 [0064.963] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml.isolated"), dwFlags=0x2) returned 1 [0065.005] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml.isolated"), dwFlags=0x2) returned 1 [0065.008] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml.isolated"), dwFlags=0x2) returned 1 [0065.012] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml.isolated"), dwFlags=0x2) returned 1 [0065.015] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml.isolated"), dwFlags=0x2) returned 1 [0065.018] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml.isolated"), dwFlags=0x2) returned 1 [0065.021] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml.isolated"), dwFlags=0x2) returned 1 [0065.024] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml.isolated"), dwFlags=0x2) returned 1 [0065.037] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml.isolated"), dwFlags=0x2) returned 1 [0065.041] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml.isolated"), dwFlags=0x2) returned 1 [0065.044] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml.isolated"), dwFlags=0x2) returned 1 [0065.047] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml.isolated"), dwFlags=0x2) returned 1 [0065.050] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml.isolated"), dwFlags=0x2) returned 1 [0065.053] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml.isolated"), dwFlags=0x2) returned 1 [0065.057] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml.isolated"), dwFlags=0x2) returned 1 [0065.061] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe531fac0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe531fac0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6288a0 [0065.068] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe531fac0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe531fac0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x628898 [0065.074] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml.isolated"), dwFlags=0x2) returned 1 [0065.079] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml.isolated"), dwFlags=0x2) returned 1 [0065.085] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml.isolated"), dwFlags=0x2) returned 1 [0065.091] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml.isolated"), dwFlags=0x2) returned 1 [0065.099] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml.isolated"), dwFlags=0x2) returned 1 [0065.105] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml.isolated"), dwFlags=0x2) returned 1 [0065.111] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml.isolated"), dwFlags=0x2) returned 1 [0065.117] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml.isolated"), dwFlags=0x2) returned 1 [0065.122] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml.isolated"), dwFlags=0x2) returned 1 [0065.127] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml.isolated"), dwFlags=0x2) returned 1 [0065.132] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml.isolated"), dwFlags=0x2) returned 1 [0065.138] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml.isolated"), dwFlags=0x2) returned 1 [0065.144] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml.isolated"), dwFlags=0x2) returned 1 [0065.150] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml.isolated"), dwFlags=0x2) returned 1 [0065.155] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml.isolated"), dwFlags=0x2) returned 1 [0065.160] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml.isolated"), dwFlags=0x2) returned 1 [0065.165] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml.isolated"), dwFlags=0x2) returned 1 [0065.171] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml.isolated"), dwFlags=0x2) returned 1 [0065.178] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml.isolated"), dwFlags=0x2) returned 1 [0065.183] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml.isolated"), dwFlags=0x2) returned 1 [0065.191] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml.isolated"), dwFlags=0x2) returned 1 [0065.197] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml.isolated"), dwFlags=0x2) returned 1 [0065.202] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml.isolated"), dwFlags=0x2) returned 1 [0065.207] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml.isolated"), dwFlags=0x2) returned 1 [0065.213] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml.isolated"), dwFlags=0x2) returned 1 [0065.218] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml.isolated"), dwFlags=0x2) returned 1 [0065.224] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml.isolated"), dwFlags=0x2) returned 1 [0065.230] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml.isolated"), dwFlags=0x2) returned 1 [0065.235] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml.isolated"), dwFlags=0x2) returned 1 [0065.240] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml.isolated"), dwFlags=0x2) returned 1 [0065.246] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml.isolated"), dwFlags=0x2) returned 1 [0065.253] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml.isolated"), dwFlags=0x2) returned 1 [0065.258] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml.isolated"), dwFlags=0x2) returned 1 [0065.264] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml.isolated"), dwFlags=0x2) returned 1 [0065.270] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml.isolated"), dwFlags=0x2) returned 1 [0065.276] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml.isolated"), dwFlags=0x2) returned 1 [0065.281] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml.isolated"), dwFlags=0x2) returned 1 [0065.286] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml.isolated"), dwFlags=0x2) returned 1 [0065.296] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml.isolated"), dwFlags=0x2) returned 1 [0065.305] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml.isolated"), dwFlags=0x2) returned 1 [0065.311] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml.isolated"), dwFlags=0x2) returned 1 [0065.324] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml.isolated" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml.isolated"), dwFlags=0x2) returned 1 [0065.329] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\MEDIA\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe55a7220, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe55a7220, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628770 [0065.335] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe55a7220, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe55a7220, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x628808 [0065.341] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe55cd380, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe55cd380, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6288c8 [0065.348] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe55cd380, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe55cd380, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x628808 [0065.352] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe55cd380, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe55cd380, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6288c8 [0065.360] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe55f34e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe55f34e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6288d0 [0065.368] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe55f34e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe55f34e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6288c8 [0065.376] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5619640, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe5619640, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6288c8 [0065.381] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5619640, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe5619640, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x628770 [0065.387] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe563f7a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe563f7a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x628808 [0065.393] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe563f7a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe563f7a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6288d0 [0065.400] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe563f7a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe563f7a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6288d0 [0065.401] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+connect to new data source.odc"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+connect to new data source.odc.isolated"), dwFlags=0x2) returned 1 [0065.403] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+newsqlserverconnection.odc"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+newsqlserverconnection.odc.isolated"), dwFlags=0x2) returned 1 [0065.410] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5665900, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe5665900, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6288d0 [0065.418] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif.isolated"), dwFlags=0x2) returned 1 [0065.529] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif.isolated"), dwFlags=0x2) returned 1 [0065.537] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif.isolated"), dwFlags=0x2) returned 1 [0065.562] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif.isolated"), dwFlags=0x2) returned 1 [0065.569] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif.isolated"), dwFlags=0x2) returned 1 [0065.579] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif.isolated"), dwFlags=0x2) returned 1 [0065.596] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_olivegreen.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_olivegreen.gif.isolated"), dwFlags=0x2) returned 1 [0065.605] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_premium.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_premium.gif.isolated"), dwFlags=0x2) returned 1 [0065.626] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_slateblue.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_slateblue.gif.isolated"), dwFlags=0x2) returned 1 [0065.635] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_texturedblue.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_texturedblue.gif.isolated"), dwFlags=0x2) returned 1 [0065.651] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_velvetrose.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_velvetrose.gif.isolated"), dwFlags=0x2) returned 1 [0065.657] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe58c6f00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe58c6f00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0x4ca, cFileName=".", cAlternateFileName="")) returned 0x628848 [0065.661] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\adobe.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\adobe.css.isolated"), dwFlags=0x2) returned 1 [0065.667] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe58ed060, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe58ed060, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xa8, cFileName=".", cAlternateFileName="")) returned 0x628888 [0065.672] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana.css.isolated"), dwFlags=0x2) returned 1 [0065.678] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd48ff70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe58ed060, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe58ed060, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xa8, cFileName=".", cAlternateFileName="")) returned 0x628888 [0065.685] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue.css.isolated"), dwFlags=0x2) returned 1 [0065.689] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\beige.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\beige.css.isolated"), dwFlags=0x2) returned 1 [0065.694] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe59131c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe59131c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xa8, cFileName=".", cAlternateFileName="")) returned 0x628888 [0065.699] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay.css.isolated"), dwFlags=0x2) returned 1 [0065.704] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4dc230, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5939320, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe5939320, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xa8, cFileName=".", cAlternateFileName="")) returned 0x628888 [0065.706] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\background.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\background.gif.isolated"), dwFlags=0x2) returned 1 [0065.711] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange.css.isolated"), dwFlags=0x2) returned 1 [0065.717] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd502390, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe595f480, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe595f480, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xa8, cFileName=".", cAlternateFileName="")) returned 0x628888 [0065.723] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow.css.isolated"), dwFlags=0x2) returned 1 [0065.728] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\casual.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\casual.css.isolated"), dwFlags=0x2) returned 1 [0065.733] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe59855e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe59855e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xa8, cFileName=".", cAlternateFileName="")) returned 0x628888 [0065.737] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert.css.isolated"), dwFlags=0x2) returned 1 [0065.739] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\discussion.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\discussion.css.isolated"), dwFlags=0x2) returned 1 [0065.743] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\earthy.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\earthy.css.isolated"), dwFlags=0x2) returned 1 [0065.751] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe59ab740, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe59ab740, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xa8, cFileName=".", cAlternateFileName="")) returned 0x628888 [0065.756] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck.css.isolated"), dwFlags=0x2) returned 1 [0065.760] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\greentea.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\greentea.css.isolated"), dwFlags=0x2) returned 1 [0065.764] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lightspirit.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lightspirit.css.isolated"), dwFlags=0x2) returned 1 [0065.770] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe59d18a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe59d18a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0x6c9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0065.775] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime.css.isolated"), dwFlags=0x2) returned 1 [0065.779] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\maroon.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\maroon.css.isolated"), dwFlags=0x2) returned 1 [0065.785] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe59f7a00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe59f7a00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0x4c9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0065.790] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis.css.isolated"), dwFlags=0x2) returned 1 [0065.794] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\olivegreen.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\olivegreen.css.isolated"), dwFlags=0x2) returned 1 [0065.798] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\premium.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\premium.css.isolated"), dwFlags=0x2) returned 1 [0065.801] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif.isolated"), dwFlags=0x2) returned 1 [0065.804] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif.isolated"), dwFlags=0x2) returned 1 [0065.807] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif.isolated"), dwFlags=0x2) returned 1 [0065.813] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif.isolated"), dwFlags=0x2) returned 1 [0065.820] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5a43cc0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe5a43cc0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0x4c9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0065.825] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate.css.isolated"), dwFlags=0x2) returned 1 [0065.829] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slateblue.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slateblue.css.isolated"), dwFlags=0x2) returned 1 [0065.838] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5a69e20, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe5a69e20, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xa8, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0065.847] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\background.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\background.gif.isolated"), dwFlags=0x2) returned 1 [0065.854] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue.css.isolated"), dwFlags=0x2) returned 1 [0065.858] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd67f150, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5ab60e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe5ab60e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xa8, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0065.860] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\arrow.png"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\arrow.png.isolated"), dwFlags=0x2) returned 1 [0065.864] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\document.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\document.gif.isolated"), dwFlags=0x2) returned 1 [0065.869] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\generic.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\generic.gif.isolated"), dwFlags=0x2) returned 1 [0065.873] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\gradient.png"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\gradient.png.isolated"), dwFlags=0x2) returned 1 [0065.876] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\main.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\main.gif.isolated"), dwFlags=0x2) returned 1 [0065.880] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\person.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\person.gif.isolated"), dwFlags=0x2) returned 1 [0065.885] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\response.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\response.gif.isolated"), dwFlags=0x2) returned 1 [0065.893] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions.css.isolated"), dwFlags=0x2) returned 1 [0065.895] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_doc.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_doc.css.isolated"), dwFlags=0x2) returned 1 [0065.898] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_generic.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_generic.css.isolated"), dwFlags=0x2) returned 1 [0065.900] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_person.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_person.css.isolated"), dwFlags=0x2) returned 1 [0065.902] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_response.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_response.css.isolated"), dwFlags=0x2) returned 1 [0065.907] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5b28500, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe5b28500, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xa8, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0065.911] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen.css.isolated"), dwFlags=0x2) returned 1 [0065.916] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts.css.isolated"), dwFlags=0x2) returned 1 [0065.921] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5b4e660, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe5b4e660, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0x4c9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0065.923] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\background.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\background.gif.isolated"), dwFlags=0x2) returned 1 [0065.929] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2.css.isolated"), dwFlags=0x2) returned 1 [0065.935] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5b747c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe5b747c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0x4c9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0065.938] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\background.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\background.gif.isolated"), dwFlags=0x2) returned 1 [0065.943] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl.css.isolated"), dwFlags=0x2) returned 1 [0065.947] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\teal.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\teal.css.isolated"), dwFlags=0x2) returned 1 [0065.951] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\texturedblue.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\texturedblue.css.isolated"), dwFlags=0x2) returned 1 [0065.955] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\velvetrose.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\velvetrose.css.isolated"), dwFlags=0x2) returned 1 [0065.970] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\Invite or Link.one" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\invite or link.one"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\Invite or Link.one.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\invite or link.one.isolated"), dwFlags=0x2) returned 1 [0065.986] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba28770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5be6be0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe5be6be0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0065.993] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5be6be0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe5be6be0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0066.001] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5c0cd40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe5c0cd40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0066.012] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\classic.dotx"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\classic.dotx.isolated"), dwFlags=0x2) returned 1 [0066.023] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\default.dotx"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\default.dotx.isolated"), dwFlags=0x2) returned 1 [0066.082] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\defaultblackandwhite.dotx"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\defaultblackandwhite.dotx.isolated"), dwFlags=0x2) returned 1 [0066.093] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\distinctive.dotx"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\distinctive.dotx.isolated"), dwFlags=0x2) returned 1 [0066.103] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\elegant.dotx"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\elegant.dotx.isolated"), dwFlags=0x2) returned 1 [0066.114] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\fancy.dotx"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\fancy.dotx.isolated"), dwFlags=0x2) returned 1 [0066.125] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\formal.dotx"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\formal.dotx.isolated"), dwFlags=0x2) returned 1 [0066.140] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\manuscript.dotx"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\manuscript.dotx.isolated"), dwFlags=0x2) returned 1 [0066.152] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\modern.dotx"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\modern.dotx.isolated"), dwFlags=0x2) returned 1 [0066.636] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\newsprint.dotx"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\newsprint.dotx.isolated"), dwFlags=0x2) returned 1 [0066.660] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\perspective.dotx"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\perspective.dotx.isolated"), dwFlags=0x2) returned 1 [0066.675] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\simple.dotx"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\simple.dotx.isolated"), dwFlags=0x2) returned 1 [0066.698] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\thatch.dotx"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\thatch.dotx.isolated"), dwFlags=0x2) returned 1 [0066.709] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\traditional.dotx"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\traditional.dotx.isolated"), dwFlags=0x2) returned 1 [0066.721] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xe62e4c80, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe62e4c80, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc1, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0066.731] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\1036\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x779e270, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe630ade0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe630ade0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0066.736] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\3082\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a4f390, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe630ade0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe630ade0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0066.741] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe630ade0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe630ade0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0066.746] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe6330f40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe6330f40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0066.751] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\ADDINS\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe6330f40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe6330f40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0066.757] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Bibliography\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe6330f40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe6330f40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0066.762] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe63570a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe63570a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389f8 [0066.766] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe63570a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe63570a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389f8 [0066.771] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\BORDERS\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe63570a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe63570a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0066.777] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\CONVERT\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe637d200, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe637d200, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0066.782] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe637d200, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe637d200, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389f8 [0066.786] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Document Parts\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe637d200, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe637d200, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0066.793] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe63a3360, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe63a3360, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389f8 [0066.798] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe63a3360, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe63a3360, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a38 [0067.301] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\14\\built-in building blocks.dotx"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\14\\built-in building blocks.dotx.isolated"), dwFlags=0x2) returned 1 [0067.307] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\FORMS\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe688c0c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe688c0c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0067.313] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe688c0c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe688c0c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389f8 [0067.327] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe68b2220, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe68b2220, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0067.332] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe68b2220, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe68b2220, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389f8 [0067.340] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe68d8380, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe68d8380, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a38 [0067.345] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d2c00d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe68d8380, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe68d8380, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a78 [0067.348] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\signedcomponents.cer"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\signedcomponents.cer.isolated"), dwFlags=0x2) returned 1 [0067.362] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe68fe4e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe68fe4e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a78 [0067.365] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer.isolated"), dwFlags=0x2) returned 1 [0067.370] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe6924640, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe6924640, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a78 [0067.372] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\management.cer"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\management.cer.isolated"), dwFlags=0x2) returned 1 [0067.380] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe6924640, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe6924640, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a38 [0067.385] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe694a7a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe694a7a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a78 [0067.387] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_code_signing_2001-4_ca.cer"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_code_signing_2001-4_ca.cer.isolated"), dwFlags=0x2) returned 1 [0067.391] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_public_primary_ca.cer"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_public_primary_ca.cer.isolated"), dwFlags=0x2) returned 1 [0067.396] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\vs_componentsigningintermediate.cer"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\vs_componentsigningintermediate.cer.isolated"), dwFlags=0x2) returned 1 [0067.402] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe6970900, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe6970900, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389f8 [0067.407] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a72f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe6970900, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe6970900, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a38 [0067.607] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\whistling.wav"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\whistling.wav.isolated"), dwFlags=0x2) returned 1 [0067.618] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe6b85c40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe6b85c40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a38 [0067.623] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe6b85c40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe6b85c40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a38 [0067.629] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe6b85c40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe6b85c40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389f8 [0067.637] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg.isolated"), dwFlags=0x2) returned 1 [0067.641] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp.isolated"), dwFlags=0x2) returned 1 [0067.647] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp.isolated"), dwFlags=0x2) returned 1 [0067.651] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp.isolated"), dwFlags=0x2) returned 1 [0067.664] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg.isolated"), dwFlags=0x2) returned 1 [0067.670] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp.isolated"), dwFlags=0x2) returned 1 [0067.679] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg.isolated"), dwFlags=0x2) returned 1 [0067.682] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp.isolated"), dwFlags=0x2) returned 1 [0067.691] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg.isolated"), dwFlags=0x2) returned 1 [0067.695] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp.isolated"), dwFlags=0x2) returned 1 [0067.712] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg.isolated"), dwFlags=0x2) returned 1 [0067.716] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp.isolated"), dwFlags=0x2) returned 1 [0067.729] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg.isolated"), dwFlags=0x2) returned 1 [0067.744] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp.isolated"), dwFlags=0x2) returned 1 [0067.749] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg.isolated"), dwFlags=0x2) returned 1 [0067.753] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp.isolated"), dwFlags=0x2) returned 1 [0067.803] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg.isolated"), dwFlags=0x2) returned 1 [0067.814] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg.isolated"), dwFlags=0x2) returned 1 [0067.819] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp.isolated"), dwFlags=0x2) returned 1 [0067.830] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg.isolated"), dwFlags=0x2) returned 1 [0067.835] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp.isolated"), dwFlags=0x2) returned 1 [0067.846] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg.isolated"), dwFlags=0x2) returned 1 [0067.851] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp.isolated"), dwFlags=0x2) returned 1 [0067.877] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg.isolated"), dwFlags=0x2) returned 1 [0067.897] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg.isolated"), dwFlags=0x2) returned 1 [0067.904] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg.isolated"), dwFlags=0x2) returned 1 [0067.907] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg.isolated"), dwFlags=0x2) returned 1 [0067.910] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg.isolated"), dwFlags=0x2) returned 1 [0067.913] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg.isolated"), dwFlags=0x2) returned 1 [0067.916] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg.isolated"), dwFlags=0x2) returned 1 [0067.924] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp.isolated"), dwFlags=0x2) returned 1 [0067.931] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp.isolated"), dwFlags=0x2) returned 1 [0067.987] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg.isolated"), dwFlags=0x2) returned 1 [0067.996] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.002] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg.isolated"), dwFlags=0x2) returned 1 [0068.004] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.028] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg.isolated"), dwFlags=0x2) returned 1 [0068.035] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.049] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg.isolated"), dwFlags=0x2) returned 1 [0068.053] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.080] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg.isolated"), dwFlags=0x2) returned 1 [0068.086] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.094] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg.isolated"), dwFlags=0x2) returned 1 [0068.101] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.113] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp.isolated"), dwFlags=0x2) returned 1 [0068.120] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg.isolated"), dwFlags=0x2) returned 1 [0068.123] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.127] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.133] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp.isolated"), dwFlags=0x2) returned 1 [0068.136] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp.isolated"), dwFlags=0x2) returned 1 [0068.148] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg.isolated"), dwFlags=0x2) returned 1 [0068.153] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.157] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg.isolated"), dwFlags=0x2) returned 1 [0068.179] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg.isolated"), dwFlags=0x2) returned 1 [0068.187] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.196] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg.isolated"), dwFlags=0x2) returned 1 [0068.200] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp.isolated"), dwFlags=0x2) returned 1 [0068.212] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg.isolated"), dwFlags=0x2) returned 1 [0068.216] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.223] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe712d080, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe712d080, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389f8 [0068.229] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe71531e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe71531e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a38 [0068.234] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe71531e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe71531e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a78 [0068.248] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg.isolated"), dwFlags=0x2) returned 1 [0068.254] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.271] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg.isolated"), dwFlags=0x2) returned 1 [0068.280] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg.isolated"), dwFlags=0x2) returned 1 [0068.288] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.294] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe71eb760, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe71eb760, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a78 [0068.313] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg.isolated"), dwFlags=0x2) returned 1 [0068.330] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.345] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg.isolated"), dwFlags=0x2) returned 1 [0068.358] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.374] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg.isolated"), dwFlags=0x2) returned 1 [0068.384] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.404] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg.isolated"), dwFlags=0x2) returned 1 [0068.416] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.435] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg.isolated"), dwFlags=0x2) returned 1 [0068.445] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.452] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg.isolated"), dwFlags=0x2) returned 1 [0068.461] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.479] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg.isolated"), dwFlags=0x2) returned 1 [0068.489] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.505] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg.isolated"), dwFlags=0x2) returned 1 [0068.515] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.526] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg.isolated"), dwFlags=0x2) returned 1 [0068.530] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.534] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp.isolated"), dwFlags=0x2) returned 1 [0068.543] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg.isolated"), dwFlags=0x2) returned 1 [0068.556] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg.isolated"), dwFlags=0x2) returned 1 [0068.561] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.564] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp.isolated"), dwFlags=0x2) returned 1 [0068.574] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg.isolated"), dwFlags=0x2) returned 1 [0068.586] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg.isolated"), dwFlags=0x2) returned 1 [0068.589] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.599] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg.isolated"), dwFlags=0x2) returned 1 [0068.612] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg.isolated"), dwFlags=0x2) returned 1 [0068.615] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.620] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe750b440, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe750b440, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a78 [0068.626] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg.isolated"), dwFlags=0x2) returned 1 [0068.630] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.635] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe75315a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe75315a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a78 [0068.650] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg.isolated"), dwFlags=0x2) returned 1 [0068.661] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimagesmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimagesmask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.668] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe757d860, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe757d860, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a78 [0068.708] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg.isolated"), dwFlags=0x2) returned 1 [0068.713] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe75efc80, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe75efc80, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a78 [0068.724] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg.isolated"), dwFlags=0x2) returned 1 [0068.730] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.735] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg.isolated"), dwFlags=0x2) returned 1 [0068.751] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg.isolated"), dwFlags=0x2) returned 1 [0068.758] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.762] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg.isolated"), dwFlags=0x2) returned 1 [0068.765] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.770] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe7688200, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe7688200, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a78 [0068.776] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg.isolated"), dwFlags=0x2) returned 1 [0068.780] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrowmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrowmask.bmp.isolated"), dwFlags=0x2) returned 1 [0068.793] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif.isolated"), dwFlags=0x2) returned 1 [0068.802] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif.isolated"), dwFlags=0x2) returned 1 [0068.836] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif.isolated"), dwFlags=0x2) returned 1 [0068.843] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif.isolated"), dwFlags=0x2) returned 1 [0068.893] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif.isolated"), dwFlags=0x2) returned 1 [0068.917] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif.isolated"), dwFlags=0x2) returned 1 [0068.941] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif.isolated"), dwFlags=0x2) returned 1 [0068.943] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif.isolated"), dwFlags=0x2) returned 1 [0068.960] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif.isolated"), dwFlags=0x2) returned 1 [0068.978] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif.isolated"), dwFlags=0x2) returned 1 [0068.988] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif.isolated"), dwFlags=0x2) returned 1 [0069.011] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif.isolated"), dwFlags=0x2) returned 1 [0069.029] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif.isolated"), dwFlags=0x2) returned 1 [0069.059] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif.isolated"), dwFlags=0x2) returned 1 [0069.063] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif.isolated"), dwFlags=0x2) returned 1 [0069.065] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif.isolated"), dwFlags=0x2) returned 1 [0069.072] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif.isolated"), dwFlags=0x2) returned 1 [0069.074] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif.isolated"), dwFlags=0x2) returned 1 [0069.076] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif.isolated"), dwFlags=0x2) returned 1 [0069.078] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif.isolated"), dwFlags=0x2) returned 1 [0069.081] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif.isolated"), dwFlags=0x2) returned 1 [0069.083] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif.isolated"), dwFlags=0x2) returned 1 [0069.087] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif.isolated"), dwFlags=0x2) returned 1 [0069.093] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*", lpFindFileData=0x18a970 | out: lpFindFileData=0x18a970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe7981d80, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe7981d80, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638ab8 [0069.108] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg.isolated"), dwFlags=0x2) returned 1 [0069.126] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg.isolated"), dwFlags=0x2) returned 1 [0069.138] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg.isolated"), dwFlags=0x2) returned 1 [0069.158] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg.isolated"), dwFlags=0x2) returned 1 [0069.174] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg.isolated"), dwFlags=0x2) returned 1 [0069.195] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg.isolated"), dwFlags=0x2) returned 1 [0069.207] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagescript.js"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagescript.js.isolated"), dwFlags=0x2) returned 1 [0069.211] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagestyle.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagestyle.css.isolated"), dwFlags=0x2) returned 1 [0069.216] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\*", lpFindFileData=0x18a970 | out: lpFindFileData=0x18a970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe7ab2880, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe7ab2880, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638ab8 [0069.224] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg.isolated"), dwFlags=0x2) returned 1 [0069.228] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticonsmask.bmp.isolated"), dwFlags=0x2) returned 1 [0069.238] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg.isolated"), dwFlags=0x2) returned 1 [0069.329] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\grooveformsmetadata.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\grooveformsmetadata.xml.isolated"), dwFlags=0x2) returned 1 [0069.334] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif.isolated"), dwFlags=0x2) returned 1 [0069.341] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\utilityfunctions.js"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\utilityfunctions.js.isolated"), dwFlags=0x2) returned 1 [0069.357] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\validation.js"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\validation.js.isolated"), dwFlags=0x2) returned 1 [0069.360] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewdblclick.js"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewdblclick.js.isolated"), dwFlags=0x2) returned 1 [0069.365] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg.isolated"), dwFlags=0x2) returned 1 [0069.367] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewselectionchanged.js"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewselectionchanged.js.isolated"), dwFlags=0x2) returned 1 [0069.374] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe7c2f640, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe7c2f640, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a78 [0069.380] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg.isolated"), dwFlags=0x2) returned 1 [0069.385] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrowmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrowmask.bmp.isolated"), dwFlags=0x2) returned 1 [0069.392] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif.isolated"), dwFlags=0x2) returned 1 [0069.400] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif.isolated"), dwFlags=0x2) returned 1 [0069.432] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif.isolated"), dwFlags=0x2) returned 1 [0069.796] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif.isolated"), dwFlags=0x2) returned 1 [0069.879] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif.isolated"), dwFlags=0x2) returned 1 [0069.900] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif.isolated"), dwFlags=0x2) returned 1 [0069.903] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif.isolated"), dwFlags=0x2) returned 1 [0069.927] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif.isolated"), dwFlags=0x2) returned 1 [0069.930] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif.isolated"), dwFlags=0x2) returned 1 [0069.940] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif.isolated"), dwFlags=0x2) returned 1 [0069.956] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif.isolated"), dwFlags=0x2) returned 1 [0069.964] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif.isolated"), dwFlags=0x2) returned 1 [0069.985] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif.isolated"), dwFlags=0x2) returned 1 [0069.994] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif.isolated"), dwFlags=0x2) returned 1 [0070.011] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif.isolated"), dwFlags=0x2) returned 1 [0070.013] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif.isolated"), dwFlags=0x2) returned 1 [0070.014] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif.isolated"), dwFlags=0x2) returned 1 [0070.016] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif.isolated"), dwFlags=0x2) returned 1 [0070.019] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif.isolated"), dwFlags=0x2) returned 1 [0070.021] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif.isolated"), dwFlags=0x2) returned 1 [0070.023] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif.isolated"), dwFlags=0x2) returned 1 [0070.038] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagescript.js"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagescript.js.isolated"), dwFlags=0x2) returned 1 [0070.040] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagestyle.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagestyle.css.isolated"), dwFlags=0x2) returned 1 [0070.048] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*", lpFindFileData=0x18a970 | out: lpFindFileData=0x18a970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe8295160, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe8295160, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638ab8 [0070.051] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\adobe.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\adobe.css.isolated"), dwFlags=0x2) returned 1 [0070.056] GetFileType (hFile=0x6c) returned 0x1 [0070.060] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe82bb2c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe82bb2c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0070.065] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana.css.isolated"), dwFlags=0x2) returned 1 [0070.066] GetFileType (hFile=0x6c) returned 0x1 [0070.070] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe82e1420, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe82e1420, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0070.075] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue.css.isolated"), dwFlags=0x2) returned 1 [0070.077] GetFileType (hFile=0x6c) returned 0x1 [0070.081] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe8307580, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe8307580, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0070.086] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay.css.isolated"), dwFlags=0x2) returned 1 [0070.091] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe8307580, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe8307580, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0070.093] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif.isolated"), dwFlags=0x2) returned 1 [0070.094] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif.isolated"), dwFlags=0x2) returned 1 [0070.097] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif.isolated"), dwFlags=0x2) returned 1 [0070.099] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif.isolated"), dwFlags=0x2) returned 1 [0070.105] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange.css.isolated"), dwFlags=0x2) returned 1 [0070.106] GetFileType (hFile=0x6c) returned 0x1 [0070.110] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe832d6e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe832d6e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0070.115] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow.css.isolated"), dwFlags=0x2) returned 1 [0070.118] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\casual.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\casual.css.isolated"), dwFlags=0x2) returned 1 [0070.123] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\country.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\country.css.isolated"), dwFlags=0x2) returned 1 [0070.124] GetFileType (hFile=0x6c) returned 0x1 [0070.129] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe83799a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe83799a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0070.133] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert.css.isolated"), dwFlags=0x2) returned 1 [0070.137] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\earthy.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\earthy.css.isolated"), dwFlags=0x2) returned 1 [0070.140] GetFileType (hFile=0x6c) returned 0x1 [0070.144] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe839fb00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe839fb00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0070.149] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck.css.isolated"), dwFlags=0x2) returned 1 [0070.153] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\greentea.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\greentea.css.isolated"), dwFlags=0x2) returned 1 [0070.157] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lightspirit.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lightspirit.css.isolated"), dwFlags=0x2) returned 1 [0070.158] GetFileType (hFile=0x6c) returned 0x1 [0070.162] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe83c5c60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe83c5c60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0070.167] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime.css.isolated"), dwFlags=0x2) returned 1 [0070.170] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\maroon.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\maroon.css.isolated"), dwFlags=0x2) returned 1 [0070.171] GetFileType (hFile=0x6c) returned 0x1 [0070.179] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe83ebdc0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe83ebdc0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0070.185] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis.css.isolated"), dwFlags=0x2) returned 1 [0070.188] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\olivegreen.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\olivegreen.css.isolated"), dwFlags=0x2) returned 1 [0070.191] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\premium.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\premium.css.isolated"), dwFlags=0x2) returned 1 [0070.193] GetFileType (hFile=0x6c) returned 0x1 [0070.198] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe8411f20, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe8411f20, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0070.203] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate.css.isolated"), dwFlags=0x2) returned 1 [0070.207] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slateblue.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slateblue.css.isolated"), dwFlags=0x2) returned 1 [0070.208] GetFileType (hFile=0x6c) returned 0x1 [0070.212] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe8438080, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe8438080, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0070.221] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif.isolated"), dwFlags=0x2) returned 1 [0070.223] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif.isolated"), dwFlags=0x2) returned 1 [0070.225] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif.isolated"), dwFlags=0x2) returned 1 [0070.231] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue.css.isolated"), dwFlags=0x2) returned 1 [0070.232] GetFileType (hFile=0x6c) returned 0x1 [0070.236] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe845e1e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe845e1e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0070.244] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen.css.isolated"), dwFlags=0x2) returned 1 [0070.248] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts.css.isolated"), dwFlags=0x2) returned 1 [0070.253] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe84aa4a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe84aa4a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0070.255] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif.isolated"), dwFlags=0x2) returned 1 [0070.260] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif.isolated"), dwFlags=0x2) returned 1 [0070.262] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif.isolated"), dwFlags=0x2) returned 1 [0070.265] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif.isolated"), dwFlags=0x2) returned 1 [0070.270] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2.css.isolated"), dwFlags=0x2) returned 1 [0070.274] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5291c2f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe84d0600, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe84d0600, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0070.277] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif.isolated"), dwFlags=0x2) returned 1 [0070.305] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif.isolated"), dwFlags=0x2) returned 1 [0070.307] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif.isolated"), dwFlags=0x2) returned 1 [0070.309] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif.isolated"), dwFlags=0x2) returned 1 [0070.314] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl.css.isolated"), dwFlags=0x2) returned 1 [0070.325] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\teal.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\teal.css.isolated"), dwFlags=0x2) returned 1 [0070.328] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\texturedblue.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\texturedblue.css.isolated"), dwFlags=0x2) returned 1 [0070.331] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\velvetrose.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\velvetrose.css.isolated"), dwFlags=0x2) returned 1 [0070.345] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg.isolated"), dwFlags=0x2) returned 1 [0070.348] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticonsmask.bmp.isolated"), dwFlags=0x2) returned 1 [0070.357] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg.isolated"), dwFlags=0x2) returned 1 [0070.368] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form_edit.js"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form_edit.js.isolated"), dwFlags=0x2) returned 1 [0070.564] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif.isolated"), dwFlags=0x2) returned 1 [0070.572] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\publicfunctions.js"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\publicfunctions.js.isolated"), dwFlags=0x2) returned 1 [0070.576] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif.isolated"), dwFlags=0x2) returned 1 [0070.580] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif.isolated"), dwFlags=0x2) returned 1 [0070.584] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif.isolated"), dwFlags=0x2) returned 1 [0070.587] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif.isolated"), dwFlags=0x2) returned 1 [0070.591] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif.isolated"), dwFlags=0x2) returned 1 [0070.594] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif.isolated"), dwFlags=0x2) returned 1 [0070.597] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif.isolated"), dwFlags=0x2) returned 1 [0070.602] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif.isolated"), dwFlags=0x2) returned 1 [0070.606] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif.isolated"), dwFlags=0x2) returned 1 [0070.609] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif.isolated"), dwFlags=0x2) returned 1 [0070.612] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif.isolated"), dwFlags=0x2) returned 1 [0070.617] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif.isolated"), dwFlags=0x2) returned 1 [0070.645] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\utilityfunctions.js"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\utilityfunctions.js.isolated"), dwFlags=0x2) returned 1 [0070.669] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\validation.js"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\validation.js.isolated"), dwFlags=0x2) returned 1 [0070.674] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg.isolated"), dwFlags=0x2) returned 1 [0070.680] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe88ae9c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe88ae9c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a78 [0070.685] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg.isolated"), dwFlags=0x2) returned 1 [0070.690] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp.isolated"), dwFlags=0x2) returned 1 [0070.694] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif.isolated"), dwFlags=0x2) returned 1 [0070.702] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif.isolated"), dwFlags=0x2) returned 1 [0070.734] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif.isolated"), dwFlags=0x2) returned 1 [0070.741] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif.isolated"), dwFlags=0x2) returned 1 [0070.824] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif.isolated"), dwFlags=0x2) returned 1 [0070.844] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif.isolated"), dwFlags=0x2) returned 1 [0070.847] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif.isolated"), dwFlags=0x2) returned 1 [0070.869] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif.isolated"), dwFlags=0x2) returned 1 [0070.871] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif.isolated"), dwFlags=0x2) returned 1 [0070.881] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif.isolated"), dwFlags=0x2) returned 1 [0070.898] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif.isolated"), dwFlags=0x2) returned 1 [0070.907] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif.isolated"), dwFlags=0x2) returned 1 [0070.927] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif.isolated"), dwFlags=0x2) returned 1 [0070.935] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif.isolated"), dwFlags=0x2) returned 1 [0070.952] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif.isolated"), dwFlags=0x2) returned 1 [0070.956] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif.isolated"), dwFlags=0x2) returned 1 [0070.958] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif.isolated"), dwFlags=0x2) returned 1 [0070.962] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif.isolated"), dwFlags=0x2) returned 1 [0070.964] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif.isolated"), dwFlags=0x2) returned 1 [0070.967] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif.isolated"), dwFlags=0x2) returned 1 [0070.969] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif.isolated"), dwFlags=0x2) returned 1 [0070.980] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagescript.js"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagescript.js.isolated"), dwFlags=0x2) returned 1 [0070.983] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagestyle.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagestyle.css.isolated"), dwFlags=0x2) returned 1 [0070.989] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*", lpFindFileData=0x18a970 | out: lpFindFileData=0x18a970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe8ba8540, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe8ba8540, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638ab8 [0070.993] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\adobe.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\adobe.css.isolated"), dwFlags=0x2) returned 1 [0070.994] GetFileType (hFile=0x6c) returned 0x1 [0070.998] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe8ba8540, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe8ba8540, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0071.003] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana.css.isolated"), dwFlags=0x2) returned 1 [0071.004] GetFileType (hFile=0x6c) returned 0x1 [0071.008] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe8bce6a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe8bce6a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0071.016] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue.css.isolated"), dwFlags=0x2) returned 1 [0071.017] GetFileType (hFile=0x6c) returned 0x1 [0071.024] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x519a33f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe8bf4800, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe8bf4800, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0071.030] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay.css.isolated"), dwFlags=0x2) returned 1 [0071.082] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe8c8cd80, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe8c8cd80, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0071.085] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif.isolated"), dwFlags=0x2) returned 1 [0071.092] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange.css.isolated"), dwFlags=0x2) returned 1 [0071.094] GetFileType (hFile=0x6c) returned 0x1 [0071.098] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe8cb2ee0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe8cb2ee0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0071.105] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow.css.isolated"), dwFlags=0x2) returned 1 [0071.109] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\casual.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\casual.css.isolated"), dwFlags=0x2) returned 1 [0071.113] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\country.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\country.css.isolated"), dwFlags=0x2) returned 1 [0071.114] GetFileType (hFile=0x6c) returned 0x1 [0071.118] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51da7910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe8cd9040, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe8cd9040, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0071.123] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert.css.isolated"), dwFlags=0x2) returned 1 [0071.127] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\earthy.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\earthy.css.isolated"), dwFlags=0x2) returned 1 [0071.129] GetFileType (hFile=0x6c) returned 0x1 [0071.133] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52c3bfd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe8cff1a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe8cff1a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0071.138] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck.css.isolated"), dwFlags=0x2) returned 1 [0071.142] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\greentea.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\greentea.css.isolated"), dwFlags=0x2) returned 1 [0071.147] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lightspirit.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lightspirit.css.isolated"), dwFlags=0x2) returned 1 [0071.152] GetFileType (hFile=0x6c) returned 0x1 [0071.156] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x568309f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe8d25300, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe8d25300, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0071.163] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime.css.isolated"), dwFlags=0x2) returned 1 [0071.167] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\maroon.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\maroon.css.isolated"), dwFlags=0x2) returned 1 [0071.169] GetFileType (hFile=0x6c) returned 0x1 [0071.173] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe8d715c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe8d715c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0071.179] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis.css.isolated"), dwFlags=0x2) returned 1 [0071.183] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\olivegreen.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\olivegreen.css.isolated"), dwFlags=0x2) returned 1 [0071.188] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\premium.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\premium.css.isolated"), dwFlags=0x2) returned 1 [0071.192] GetFileType (hFile=0x6c) returned 0x1 [0071.197] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a9f29b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe8d97720, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe8d97720, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0071.209] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate.css.isolated"), dwFlags=0x2) returned 1 [0071.213] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slateblue.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slateblue.css.isolated"), dwFlags=0x2) returned 1 [0071.214] GetFileType (hFile=0x6c) returned 0x1 [0071.220] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe8de39e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe8de39e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0071.228] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif.isolated"), dwFlags=0x2) returned 1 [0071.236] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue.css.isolated"), dwFlags=0x2) returned 1 [0071.237] GetFileType (hFile=0x6c) returned 0x1 [0071.241] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ab49610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe8e09b40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe8e09b40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0071.286] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen.css.isolated"), dwFlags=0x2) returned 1 [0071.292] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts.css.isolated"), dwFlags=0x2) returned 1 [0071.297] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe8ea20c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe8ea20c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0071.299] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif.isolated"), dwFlags=0x2) returned 1 [0071.306] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2.css.isolated"), dwFlags=0x2) returned 1 [0071.311] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ac7a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe8ea20c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe8ea20c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0071.315] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif.isolated"), dwFlags=0x2) returned 1 [0071.328] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl.css.isolated"), dwFlags=0x2) returned 1 [0071.333] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\teal.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\teal.css.isolated"), dwFlags=0x2) returned 1 [0071.339] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\texturedblue.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\texturedblue.css.isolated"), dwFlags=0x2) returned 1 [0071.343] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\velvetrose.css"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\velvetrose.css.isolated"), dwFlags=0x2) returned 1 [0071.352] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg.isolated"), dwFlags=0x2) returned 1 [0071.356] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticonsmask.bmp.isolated"), dwFlags=0x2) returned 1 [0071.366] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg.isolated"), dwFlags=0x2) returned 1 [0071.378] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form_edit.js"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form_edit.js.isolated"), dwFlags=0x2) returned 1 [0071.422] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif.isolated"), dwFlags=0x2) returned 1 [0071.434] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\publicfunctions.js"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\publicfunctions.js.isolated"), dwFlags=0x2) returned 1 [0071.437] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif.isolated"), dwFlags=0x2) returned 1 [0071.537] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif.isolated"), dwFlags=0x2) returned 1 [0071.568] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif.isolated"), dwFlags=0x2) returned 1 [0071.571] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif.isolated"), dwFlags=0x2) returned 1 [0071.574] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif.isolated"), dwFlags=0x2) returned 1 [0071.578] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif.isolated"), dwFlags=0x2) returned 1 [0071.581] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif.isolated"), dwFlags=0x2) returned 1 [0071.583] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif.isolated"), dwFlags=0x2) returned 1 [0071.586] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif.isolated"), dwFlags=0x2) returned 1 [0071.595] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif.isolated"), dwFlags=0x2) returned 1 [0071.599] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif.isolated"), dwFlags=0x2) returned 1 [0071.603] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif.isolated"), dwFlags=0x2) returned 1 [0071.604] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif.isolated"), dwFlags=0x2) returned 1 [0071.615] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif.isolated"), dwFlags=0x2) returned 1 [0071.691] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\utilityfunctions.js"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\utilityfunctions.js.isolated"), dwFlags=0x2) returned 1 [0071.773] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\validation.js"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\validation.js.isolated"), dwFlags=0x2) returned 1 [0071.779] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg.isolated"), dwFlags=0x2) returned 1 [0071.786] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe933eb60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe933eb60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a78 [0071.808] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif.isolated"), dwFlags=0x2) returned 1 [0071.821] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg.isolated"), dwFlags=0x2) returned 1 [0071.825] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticonsmask.bmp.isolated"), dwFlags=0x2) returned 1 [0071.837] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form_edit.js"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form_edit.js.isolated"), dwFlags=0x2) returned 1 [0071.910] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg.isolated"), dwFlags=0x2) returned 1 [0072.097] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif.isolated"), dwFlags=0x2) returned 1 [0072.110] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\publicfunctions.js"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\publicfunctions.js.isolated"), dwFlags=0x2) returned 1 [0072.114] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif.isolated"), dwFlags=0x2) returned 1 [0072.117] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif.isolated"), dwFlags=0x2) returned 1 [0072.120] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif.isolated"), dwFlags=0x2) returned 1 [0072.123] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif.isolated"), dwFlags=0x2) returned 1 [0072.126] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif.isolated"), dwFlags=0x2) returned 1 [0072.131] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif.isolated"), dwFlags=0x2) returned 1 [0072.135] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif.isolated"), dwFlags=0x2) returned 1 [0072.137] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif.isolated"), dwFlags=0x2) returned 1 [0072.140] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif.isolated"), dwFlags=0x2) returned 1 [0072.144] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif.isolated"), dwFlags=0x2) returned 1 [0072.201] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\utilityfunctions.js"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\utilityfunctions.js.isolated"), dwFlags=0x2) returned 1 [0072.233] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\validation.js"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\validation.js.isolated"), dwFlags=0x2) returned 1 [0072.239] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe978f340, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe978f340, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a78 [0072.246] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg.isolated"), dwFlags=0x2) returned 1 [0072.252] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseiconmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseiconmask.bmp.isolated"), dwFlags=0x2) returned 1 [0072.276] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg.isolated"), dwFlags=0x2) returned 1 [0072.285] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleiconsmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleiconsmask.bmp.isolated"), dwFlags=0x2) returned 1 [0072.301] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg.isolated"), dwFlags=0x2) returned 1 [0072.305] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingiconmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingiconmask.bmp.isolated"), dwFlags=0x2) returned 1 [0072.315] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg.isolated"), dwFlags=0x2) returned 1 [0072.328] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusiconsmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusiconsmask.bmp.isolated"), dwFlags=0x2) returned 1 [0072.339] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg.isolated"), dwFlags=0x2) returned 1 [0072.344] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskiconmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskiconmask.bmp.isolated"), dwFlags=0x2) returned 1 [0072.346] GetFileType (hFile=0x68) returned 0x1 [0072.350] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\*", lpFindFileData=0x18a970 | out: lpFindFileData=0x18a970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe9899ce0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe9899ce0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638ab8 [0072.351] GetFileType (hFile=0x6c) returned 0x1 [0072.355] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\*", lpFindFileData=0x18a00c | out: lpFindFileData=0x18a00c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe9899ce0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe9899ce0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638af8 [0072.356] GetFileType (hFile=0x70) returned 0x1 [0072.361] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\*", lpFindFileData=0x1896a8 | out: lpFindFileData=0x1896a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6073a7d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe98bfe40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe98bfe40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638b38 [0072.366] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\*", lpFindFileData=0x1896a8 | out: lpFindFileData=0x1896a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe98bfe40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe98bfe40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638b38 [0072.375] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.js"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.js.isolated"), dwFlags=0x2) returned 1 [0072.398] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg.isolated"), dwFlags=0x2) returned 1 [0072.411] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimagesmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimagesmask.bmp.isolated"), dwFlags=0x2) returned 1 [0072.445] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg.isolated"), dwFlags=0x2) returned 1 [0072.523] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimagemask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimagemask.bmp.isolated"), dwFlags=0x2) returned 1 [0072.545] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whiteboxmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whiteboxmask.bmp.isolated"), dwFlags=0x2) returned 1 [0072.551] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg.isolated"), dwFlags=0x2) returned 1 [0072.557] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomiconsmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomiconsmask.bmp.isolated"), dwFlags=0x2) returned 1 [0072.563] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\*", lpFindFileData=0x18b2d4 | out: lpFindFileData=0x18b2d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53907610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe9aaf020, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe9aaf020, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a78 [0072.570] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg.isolated"), dwFlags=0x2) returned 1 [0072.577] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimagesmask.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimagesmask.bmp.isolated"), dwFlags=0x2) returned 1 [0072.582] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a4cdf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe9ad5180, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe9ad5180, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389f8 [0072.588] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe9ad5180, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe9ad5180, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389f8 [0072.589] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\messenger.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\messenger.xml.isolated"), dwFlags=0x2) returned 1 [0072.590] GetFileType (hFile=0x60) returned 0x1 [0072.595] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe9afb2e0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe9afb2e0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a38 [0072.699] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starterapplicationdescriptors.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starterapplicationdescriptors.xml.isolated"), dwFlags=0x2) returned 1 [0072.805] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starternotificationdescriptors.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starternotificationdescriptors.xml.isolated"), dwFlags=0x2) returned 1 [0072.915] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\startertooltemplates.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\startertooltemplates.xml.isolated"), dwFlags=0x2) returned 1 [0072.927] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe9e1afc0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe9e1afc0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0072.932] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe9e1afc0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe9e1afc0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389f8 [0072.937] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe9e41120, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xe9e41120, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a38 [0073.195] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.xml.isolated"), dwFlags=0x2) returned 1 [0073.453] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.xml.isolated"), dwFlags=0x2) returned 1 [0073.458] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xea329e80, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xea329e80, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389f8 [0073.873] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.xml.isolated"), dwFlags=0x2) returned 1 [0074.125] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.xml.isolated"), dwFlags=0x2) returned 1 [0074.130] GetFileType (hFile=0x58) returned 0x1 [0074.147] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Library\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xea9b5b00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xea9b5b00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0074.152] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xea9b5b00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xea9b5b00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389f8 [0074.152] GetFileType (hFile=0x5c) returned 0x1 [0074.173] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeaa01dc0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xeaa01dc0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389f8 [0074.178] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\MEDIA\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xeaa01dc0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xeaa01dc0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0074.561] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.xml.isolated"), dwFlags=0x2) returned 1 [0074.577] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.xml.isolated"), dwFlags=0x2) returned 1 [0074.579] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.xml.isolated"), dwFlags=0x2) returned 1 [0074.792] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.xml.isolated"), dwFlags=0x2) returned 1 [0075.328] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.xml.isolated"), dwFlags=0x2) returned 1 [0076.297] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.xml.isolated"), dwFlags=0x2) returned 1 [0076.696] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.xml.isolated"), dwFlags=0x2) returned 1 [0076.704] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\OneNote\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xec21bc80, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xec21bc80, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0076.706] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote-pipelineconfig.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote-pipelineconfig.xml.isolated"), dwFlags=0x2) returned 1 [0076.711] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xec241de0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xec241de0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0076.720] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xec241de0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xec241de0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0076.734] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\PROOF\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xec267f40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xec267f40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0076.735] GetFileType (hFile=0x5c) returned 0x1 [0076.741] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xec267f40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xec267f40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389f8 [0076.742] GetFileType (hFile=0x5c) returned 0x1 [0076.747] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec28e0a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xec28e0a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389f8 [0076.747] GetFileType (hFile=0x5c) returned 0x1 [0076.753] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xec28e0a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xec28e0a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389f8 [0076.759] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\PUBBA\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xec2b4200, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xec2b4200, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0076.767] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xec2b4200, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xec2b4200, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0076.779] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\QUERIES\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xec2da360, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xec2da360, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0076.780] GetFileType (hFile=0x58) returned 0x1 [0076.791] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa671530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xec3004c0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xec3004c0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0076.793] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml" (normalized: "c:\\program files\\microsoft office\\office14\\sketchpadtestschema.xml"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\sketchpadtestschema.xml.isolated"), dwFlags=0x2) returned 1 [0076.882] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\splashscreen.bmp"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp.isolated" (normalized: "c:\\program files\\microsoft office\\office14\\splashscreen.bmp.isolated"), dwFlags=0x2) returned 1 [0076.884] GetFileType (hFile=0x58) returned 0x1 [0076.888] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\STARTUP\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xec3e4d00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xec3e4d00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0076.891] GetFileType (hFile=0x58) returned 0x1 [0076.895] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Visio Content\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec3e4d00, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xec3e4d00, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0076.903] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec40ae60, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xec40ae60, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389f8 [0076.920] GetFileType (hFile=0x58) returned 0x1 [0076.925] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Office14\\XLSTART\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xec430fc0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xec430fc0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0076.926] GetFileType (hFile=0x54) returned 0x1 [0076.931] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Stationery\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xec457120, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xec457120, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0076.936] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Stationery\\1033\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xec457120, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xec457120, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389f8 [0076.937] GetFileType (hFile=0x54) returned 0x1 [0076.981] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\*", lpFindFileData=0x18d864 | out: lpFindFileData=0x18d864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xec4c9540, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xec4c9540, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0x80, cFileName=".", cAlternateFileName="")) returned 0x6389b8 [0076.987] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\*", lpFindFileData=0x18cf00 | out: lpFindFileData=0x18cf00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xec4c9540, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xec4c9540, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x6389f8 [0076.993] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*", lpFindFileData=0x18c59c | out: lpFindFileData=0x18c59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xec4ef6a0, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xec4ef6a0, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a38 [0077.778] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\assets.accdt"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt.isolated" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\assets.accdt.isolated"), dwFlags=0x2) returned 1 [0078.430] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\charitable contributions.accdt"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt.isolated" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\charitable contributions.accdt.isolated"), dwFlags=0x2) returned 1 [0078.922] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\contacts.accdt"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt.isolated" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\contacts.accdt.isolated"), dwFlags=0x2) returned 1 [0078.928] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f30ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xed762120, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xed762120, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a78 [0079.120] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Events.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\events.accdt"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Events.accdt.isolated" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\events.accdt.isolated"), dwFlags=0x2) returned 1 [0079.824] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Faculty.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\faculty.accdt"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Faculty.accdt.isolated" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\faculty.accdt.isolated"), dwFlags=0x2) returned 1 [0080.402] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Issues.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\issues.accdt"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Issues.accdt.isolated" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\issues.accdt.isolated"), dwFlags=0x2) returned 1 [0081.012] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Marketing Projects.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\marketing projects.accdt"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Marketing Projects.accdt.isolated" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\marketing projects.accdt.isolated"), dwFlags=0x2) returned 1 [0081.589] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Northwind.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\northwind.accdt"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Northwind.accdt.isolated" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\northwind.accdt.isolated"), dwFlags=0x2) returned 1 [0081.595] FindFirstFileA (in: lpFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\*", lpFindFileData=0x18bc38 | out: lpFindFileData=0x18bc38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14fa2ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xef0d2c40, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xef0d2c40, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x621c18, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x638a78 [0081.628] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Right.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\1 right.accdt"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Right.accdt.isolated" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\1 right.accdt.isolated"), dwFlags=0x2) returned 1 [0081.654] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Top.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\1 top.accdt"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Top.accdt.isolated" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\1 top.accdt.isolated"), dwFlags=0x2) returned 1 [0081.681] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2 Right.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2 right.accdt"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2 Right.accdt.isolated" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2 right.accdt.isolated"), dwFlags=0x2) returned 1 [0081.709] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2 Top.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2 top.accdt"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\2 Top.accdt.isolated" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\2 top.accdt.isolated"), dwFlags=0x2) returned 1 [0081.731] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Comments.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\comments.accdt"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Comments.accdt.isolated" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\comments.accdt.isolated"), dwFlags=0x2) returned 1 [0082.045] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Contacts.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\contacts.accdt"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Contacts.accdt.isolated" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\contacts.accdt.isolated"), dwFlags=0x2) returned 1 [0082.068] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Details.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\details.accdt"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Details.accdt.isolated" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\details.accdt.isolated"), dwFlags=0x2) returned 1 [0082.093] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Dialog.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\dialog.accdt"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Dialog.accdt.isolated" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\dialog.accdt.isolated"), dwFlags=0x2) returned 1 [0082.145] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Issues.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\issues.accdt"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Issues.accdt.isolated" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\issues.accdt.isolated"), dwFlags=0x2) returned 1 [0082.172] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\List.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\list.accdt"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\List.accdt.isolated" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\list.accdt.isolated"), dwFlags=0x2) returned 1 [0082.194] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Media.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\media.accdt"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Media.accdt.isolated" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\media.accdt.isolated"), dwFlags=0x2) returned 1 [0082.218] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Msgbox.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\msgbox.accdt"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Msgbox.accdt.isolated" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\msgbox.accdt.isolated"), dwFlags=0x2) returned 1 [0082.244] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Tabs.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\tabs.accdt"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Tabs.accdt.isolated" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\tabs.accdt.isolated"), dwFlags=0x2) returned 1 [0082.288] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Tasks.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\tasks.accdt"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Tasks.accdt.isolated" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\tasks.accdt.isolated"), dwFlags=0x2) returned 1 [0082.326] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Users.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\users.accdt"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\Users.accdt.isolated" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\part\\users.accdt.isolated"), dwFlags=0x2) returned 1 [0082.845] MoveFileExW (lpExistingFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Projects.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\projects.accdt"), lpNewFileName="C:\\\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Projects.accdt.isolated" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\projects.accdt.isolated"), dwFlags=0x2) returned 1 Thread: id = 127 os_tid = 0x408 Process: id = "13" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x5d28c000" os_pid = "0x410" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xb14" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /C choice /C Y /N /D Y /T 3 & Del \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 119 os_tid = 0x7e8 [0060.983] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x40fe58 | out: lpSystemTimeAsFileTime=0x40fe58*(dwLowDateTime=0xe2c25280, dwHighDateTime=0x1d531b1)) [0060.983] GetCurrentProcessId () returned 0x410 [0060.983] GetCurrentThreadId () returned 0x7e8 [0060.983] GetTickCount () returned 0x1deaa [0060.984] QueryPerformanceCounter (in: lpPerformanceCount=0x40fe50 | out: lpPerformanceCount=0x40fe50*=18124514651) returned 1 [0060.984] GetModuleHandleA (lpModuleName=0x0) returned 0x4a8c0000 [0060.985] __set_app_type (_Type=0x1) [0060.985] __p__fmode () returned 0x74eb31f4 [0060.985] __p__commode () returned 0x74eb31fc [0060.985] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a8e21a6) returned 0x0 [0060.985] __getmainargs (in: _Argc=0x4a8e4238, _Argv=0x4a8e4240, _Env=0x4a8e423c, _DoWildCard=0, _StartInfo=0x4a8e4140 | out: _Argc=0x4a8e4238, _Argv=0x4a8e4240, _Env=0x4a8e423c) returned 0 [0060.985] GetCurrentThreadId () returned 0x7e8 [0060.985] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x7e8) returned 0x60 [0060.985] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0060.985] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadUILanguage") returned 0x76c4a84f [0060.985] SetThreadUILanguage (LangId=0x0) returned 0x409 [0060.986] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0060.986] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x40fde8 | out: phkResult=0x40fde8*=0x0) returned 0x2 [0060.986] VirtualQuery (in: lpAddress=0x40fe1f, lpBuffer=0x40fdb8, dwLength=0x1c | out: lpBuffer=0x40fdb8*(BaseAddress=0x40f000, AllocationBase=0x310000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0060.986] VirtualQuery (in: lpAddress=0x310000, lpBuffer=0x40fdb8, dwLength=0x1c | out: lpBuffer=0x40fdb8*(BaseAddress=0x310000, AllocationBase=0x310000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0060.986] VirtualQuery (in: lpAddress=0x311000, lpBuffer=0x40fdb8, dwLength=0x1c | out: lpBuffer=0x40fdb8*(BaseAddress=0x311000, AllocationBase=0x310000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0060.986] VirtualQuery (in: lpAddress=0x313000, lpBuffer=0x40fdb8, dwLength=0x1c | out: lpBuffer=0x40fdb8*(BaseAddress=0x313000, AllocationBase=0x310000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0060.986] VirtualQuery (in: lpAddress=0x410000, lpBuffer=0x40fdb8, dwLength=0x1c | out: lpBuffer=0x40fdb8*(BaseAddress=0x410000, AllocationBase=0x410000, AllocationProtect=0x2, RegionSize=0x181000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0060.986] GetConsoleOutputCP () returned 0x1b5 [0060.986] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a8e4260 | out: lpCPInfo=0x4a8e4260) returned 1 [0060.986] SetConsoleCtrlHandler (HandlerRoutine=0x4a8de72a, Add=1) returned 1 [0060.986] _get_osfhandle (_FileHandle=1) returned 0x7 [0060.986] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0060.987] _get_osfhandle (_FileHandle=1) returned 0x7 [0060.987] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8e41ac | out: lpMode=0x4a8e41ac) returned 1 [0060.987] _get_osfhandle (_FileHandle=1) returned 0x7 [0060.987] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0060.987] _get_osfhandle (_FileHandle=0) returned 0x3 [0060.987] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8e41b0 | out: lpMode=0x4a8e41b0) returned 1 [0060.987] _get_osfhandle (_FileHandle=0) returned 0x3 [0060.987] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0060.988] GetEnvironmentStringsW () returned 0x7c2118* [0060.988] GetProcessHeap () returned 0x7b0000 [0060.988] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0xaca) returned 0x7c2bf0 [0060.988] FreeEnvironmentStringsW (penv=0x7c2118) returned 1 [0060.988] GetProcessHeap () returned 0x7b0000 [0060.988] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x4) returned 0x7c18b0 [0060.988] GetEnvironmentStringsW () returned 0x7c2118* [0060.988] GetProcessHeap () returned 0x7b0000 [0060.988] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0xaca) returned 0x7c36c8 [0060.988] FreeEnvironmentStringsW (penv=0x7c2118) returned 1 [0060.988] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x40ed58 | out: phkResult=0x40ed58*=0x68) returned 0x0 [0060.988] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x40ed60, lpData=0x40ed64, lpcbData=0x40ed5c*=0x1000 | out: lpType=0x40ed60*=0x0, lpData=0x40ed64*=0x0, lpcbData=0x40ed5c*=0x1000) returned 0x2 [0060.988] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x40ed60, lpData=0x40ed64, lpcbData=0x40ed5c*=0x1000 | out: lpType=0x40ed60*=0x4, lpData=0x40ed64*=0x1, lpcbData=0x40ed5c*=0x4) returned 0x0 [0060.988] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x40ed60, lpData=0x40ed64, lpcbData=0x40ed5c*=0x1000 | out: lpType=0x40ed60*=0x0, lpData=0x40ed64*=0x1, lpcbData=0x40ed5c*=0x1000) returned 0x2 [0060.988] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x40ed60, lpData=0x40ed64, lpcbData=0x40ed5c*=0x1000 | out: lpType=0x40ed60*=0x4, lpData=0x40ed64*=0x0, lpcbData=0x40ed5c*=0x4) returned 0x0 [0060.988] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x40ed60, lpData=0x40ed64, lpcbData=0x40ed5c*=0x1000 | out: lpType=0x40ed60*=0x4, lpData=0x40ed64*=0x40, lpcbData=0x40ed5c*=0x4) returned 0x0 [0060.988] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x40ed60, lpData=0x40ed64, lpcbData=0x40ed5c*=0x1000 | out: lpType=0x40ed60*=0x4, lpData=0x40ed64*=0x40, lpcbData=0x40ed5c*=0x4) returned 0x0 [0060.989] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x40ed60, lpData=0x40ed64, lpcbData=0x40ed5c*=0x1000 | out: lpType=0x40ed60*=0x0, lpData=0x40ed64*=0x40, lpcbData=0x40ed5c*=0x1000) returned 0x2 [0060.989] RegCloseKey (hKey=0x68) returned 0x0 [0060.989] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x40ed58 | out: phkResult=0x40ed58*=0x68) returned 0x0 [0060.989] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x40ed60, lpData=0x40ed64, lpcbData=0x40ed5c*=0x1000 | out: lpType=0x40ed60*=0x0, lpData=0x40ed64*=0x40, lpcbData=0x40ed5c*=0x1000) returned 0x2 [0060.989] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x40ed60, lpData=0x40ed64, lpcbData=0x40ed5c*=0x1000 | out: lpType=0x40ed60*=0x4, lpData=0x40ed64*=0x1, lpcbData=0x40ed5c*=0x4) returned 0x0 [0060.989] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x40ed60, lpData=0x40ed64, lpcbData=0x40ed5c*=0x1000 | out: lpType=0x40ed60*=0x0, lpData=0x40ed64*=0x1, lpcbData=0x40ed5c*=0x1000) returned 0x2 [0060.989] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x40ed60, lpData=0x40ed64, lpcbData=0x40ed5c*=0x1000 | out: lpType=0x40ed60*=0x4, lpData=0x40ed64*=0x0, lpcbData=0x40ed5c*=0x4) returned 0x0 [0060.989] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x40ed60, lpData=0x40ed64, lpcbData=0x40ed5c*=0x1000 | out: lpType=0x40ed60*=0x4, lpData=0x40ed64*=0x9, lpcbData=0x40ed5c*=0x4) returned 0x0 [0060.989] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x40ed60, lpData=0x40ed64, lpcbData=0x40ed5c*=0x1000 | out: lpType=0x40ed60*=0x4, lpData=0x40ed64*=0x9, lpcbData=0x40ed5c*=0x4) returned 0x0 [0060.989] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x40ed60, lpData=0x40ed64, lpcbData=0x40ed5c*=0x1000 | out: lpType=0x40ed60*=0x0, lpData=0x40ed64*=0x9, lpcbData=0x40ed5c*=0x1000) returned 0x2 [0060.989] RegCloseKey (hKey=0x68) returned 0x0 [0060.989] time (in: timer=0x0 | out: timer=0x0) returned 0x5d1cc620 [0060.989] srand (_Seed=0x5d1cc620) [0060.989] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C choice /C Y /N /D Y /T 3 & Del \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\"" [0060.989] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C choice /C Y /N /D Y /T 3 & Del \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\"" [0060.989] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a8e5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0060.990] GetProcessHeap () returned 0x7b0000 [0060.990] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x210) returned 0x7c2118 [0060.990] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7c2120, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0060.990] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a8f0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0060.990] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a8f0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0060.990] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a8f0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0060.990] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0060.990] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0060.990] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0060.990] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0060.990] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0060.990] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0060.990] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0060.990] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0060.990] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0060.990] GetProcessHeap () returned 0x7b0000 [0060.990] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c2bf0 | out: hHeap=0x7b0000) returned 1 [0060.990] GetEnvironmentStringsW () returned 0x7c2330* [0060.990] GetProcessHeap () returned 0x7b0000 [0060.990] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0xae2) returned 0x7c4c90 [0060.990] FreeEnvironmentStringsW (penv=0x7c2330) returned 1 [0060.990] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a8f0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0060.990] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a8f0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0060.990] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0060.990] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0060.990] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0060.990] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0060.991] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0060.991] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0060.991] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0060.991] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0060.991] GetProcessHeap () returned 0x7b0000 [0060.991] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x54) returned 0x7c17e0 [0060.991] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x40fb24 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0060.991] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x40fb24, lpFilePart=0x40fb20 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x40fb20*="Desktop") returned 0x25 [0060.991] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0060.991] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x40f8a0 | out: lpFindFileData=0x40f8a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x7c5780 [0060.991] FindClose (in: hFindFile=0x7c5780 | out: hFindFile=0x7c5780) returned 1 [0060.991] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x40f8a0 | out: lpFindFileData=0x40f8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x7c5780 [0060.991] FindClose (in: hFindFile=0x7c5780 | out: hFindFile=0x7c5780) returned 1 [0060.991] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0060.991] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x40f8a0 | out: lpFindFileData=0x40f8a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcf1cdf70, ftLastAccessTime.dwHighDateTime=0x1d531b1, ftLastWriteTime.dwLowDateTime=0xcf1cdf70, ftLastWriteTime.dwHighDateTime=0x1d531b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x7c5780 [0060.991] FindClose (in: hFindFile=0x7c5780 | out: hFindFile=0x7c5780) returned 1 [0060.992] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0060.992] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0060.992] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0060.992] GetProcessHeap () returned 0x7b0000 [0060.992] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c4c90 | out: hHeap=0x7b0000) returned 1 [0060.992] GetEnvironmentStringsW () returned 0x7c41a0* [0060.992] GetProcessHeap () returned 0x7b0000 [0060.992] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0xb36) returned 0x7c5fc0 [0060.992] FreeEnvironmentStringsW (penv=0x7c41a0) returned 1 [0060.992] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a8e5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0060.992] GetProcessHeap () returned 0x7b0000 [0060.992] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c17e0 | out: hHeap=0x7b0000) returned 1 [0060.992] GetProcessHeap () returned 0x7b0000 [0060.992] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x400e) returned 0x7c6b00 [0060.992] GetProcessHeap () returned 0x7b0000 [0060.992] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0xc0) returned 0x7c2e70 [0060.992] GetProcessHeap () returned 0x7b0000 [0060.992] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c6b00 | out: hHeap=0x7b0000) returned 1 [0060.992] GetConsoleOutputCP () returned 0x1b5 [0061.013] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a8e4260 | out: lpCPInfo=0x4a8e4260) returned 1 [0061.013] GetUserDefaultLCID () returned 0x409 [0061.014] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a8e4950, cchData=8 | out: lpLCData=":") returned 2 [0061.014] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x40fc64, cchData=128 | out: lpLCData="0") returned 2 [0061.014] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x40fc64, cchData=128 | out: lpLCData="0") returned 2 [0061.014] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x40fc64, cchData=128 | out: lpLCData="1") returned 2 [0061.014] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a8e4940, cchData=8 | out: lpLCData="/") returned 2 [0061.014] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a8e4d80, cchData=32 | out: lpLCData="Mon") returned 4 [0061.015] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a8e4d40, cchData=32 | out: lpLCData="Tue") returned 4 [0061.015] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a8e4d00, cchData=32 | out: lpLCData="Wed") returned 4 [0061.015] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a8e4cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0061.015] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a8e4c80, cchData=32 | out: lpLCData="Fri") returned 4 [0061.015] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a8e4c40, cchData=32 | out: lpLCData="Sat") returned 4 [0061.015] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a8e4c00, cchData=32 | out: lpLCData="Sun") returned 4 [0061.015] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a8e4930, cchData=8 | out: lpLCData=".") returned 2 [0061.015] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a8e4920, cchData=8 | out: lpLCData=",") returned 2 [0061.015] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0061.016] GetProcessHeap () returned 0x7b0000 [0061.016] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x20c) returned 0x7c2f38 [0061.016] GetConsoleTitleW (in: lpConsoleTitle=0x7c2f38, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0061.016] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0061.016] GetProcAddress (hModule=0x76c20000, lpProcName="CopyFileExW") returned 0x76c53b92 [0061.016] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0061.016] GetProcAddress (hModule=0x76c20000, lpProcName="SetConsoleInputExeNameW") returned 0x76c4a79d [0061.017] GetProcessHeap () returned 0x7b0000 [0061.017] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x400a) returned 0x7c6b00 [0061.017] GetProcessHeap () returned 0x7b0000 [0061.017] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c6b00 | out: hHeap=0x7b0000) returned 1 [0061.017] _wcsicmp (_String1="choice", _String2=")") returned 58 [0061.017] _wcsicmp (_String1="FOR", _String2="choice") returned 3 [0061.017] _wcsicmp (_String1="FOR/?", _String2="choice") returned 3 [0061.017] _wcsicmp (_String1="IF", _String2="choice") returned 6 [0061.017] _wcsicmp (_String1="IF/?", _String2="choice") returned 6 [0061.017] _wcsicmp (_String1="REM", _String2="choice") returned 15 [0061.017] _wcsicmp (_String1="REM/?", _String2="choice") returned 15 [0061.017] GetProcessHeap () returned 0x7b0000 [0061.017] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x58) returned 0x7c3150 [0061.017] GetProcessHeap () returned 0x7b0000 [0061.017] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x16) returned 0x7c1818 [0061.018] GetProcessHeap () returned 0x7b0000 [0061.018] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x30) returned 0x7c31b0 [0061.018] GetProcessHeap () returned 0x7b0000 [0061.018] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x58) returned 0x7c31e8 [0061.019] _wcsicmp (_String1="Del", _String2=")") returned 59 [0061.019] _wcsicmp (_String1="FOR", _String2="Del") returned 2 [0061.019] _wcsicmp (_String1="FOR/?", _String2="Del") returned 2 [0061.019] _wcsicmp (_String1="IF", _String2="Del") returned 5 [0061.019] _wcsicmp (_String1="IF/?", _String2="Del") returned 5 [0061.019] _wcsicmp (_String1="REM", _String2="Del") returned 14 [0061.019] _wcsicmp (_String1="REM/?", _String2="Del") returned 14 [0061.019] GetProcessHeap () returned 0x7b0000 [0061.019] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x58) returned 0x7c3248 [0061.019] GetProcessHeap () returned 0x7b0000 [0061.019] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x10) returned 0x7bffd8 [0061.020] GetProcessHeap () returned 0x7b0000 [0061.020] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x80) returned 0x7c32a8 [0061.021] GetConsoleTitleW (in: lpConsoleTitle=0x40f8f8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0061.021] _wcsicmp (_String1="choice", _String2="DIR") returned -1 [0061.021] _wcsicmp (_String1="choice", _String2="ERASE") returned -2 [0061.021] _wcsicmp (_String1="choice", _String2="DEL") returned -1 [0061.021] _wcsicmp (_String1="choice", _String2="TYPE") returned -17 [0061.021] _wcsicmp (_String1="choice", _String2="COPY") returned -7 [0061.021] _wcsicmp (_String1="choice", _String2="CD") returned 4 [0061.021] _wcsicmp (_String1="choice", _String2="CHDIR") returned 11 [0061.021] _wcsicmp (_String1="choice", _String2="RENAME") returned -15 [0061.021] _wcsicmp (_String1="choice", _String2="REN") returned -15 [0061.021] _wcsicmp (_String1="choice", _String2="ECHO") returned -2 [0061.021] _wcsicmp (_String1="choice", _String2="SET") returned -16 [0061.021] _wcsicmp (_String1="choice", _String2="PAUSE") returned -13 [0061.022] _wcsicmp (_String1="choice", _String2="DATE") returned -1 [0061.022] _wcsicmp (_String1="choice", _String2="TIME") returned -17 [0061.022] _wcsicmp (_String1="choice", _String2="PROMPT") returned -13 [0061.022] _wcsicmp (_String1="choice", _String2="MD") returned -10 [0061.022] _wcsicmp (_String1="choice", _String2="MKDIR") returned -10 [0061.022] _wcsicmp (_String1="choice", _String2="RD") returned -15 [0061.022] _wcsicmp (_String1="choice", _String2="RMDIR") returned -15 [0061.022] _wcsicmp (_String1="choice", _String2="PATH") returned -13 [0061.022] _wcsicmp (_String1="choice", _String2="GOTO") returned -4 [0061.022] _wcsicmp (_String1="choice", _String2="SHIFT") returned -16 [0061.022] _wcsicmp (_String1="choice", _String2="CLS") returned -4 [0061.022] _wcsicmp (_String1="choice", _String2="CALL") returned 7 [0061.022] _wcsicmp (_String1="choice", _String2="VERIFY") returned -19 [0061.022] _wcsicmp (_String1="choice", _String2="VER") returned -19 [0061.022] _wcsicmp (_String1="choice", _String2="VOL") returned -19 [0061.022] _wcsicmp (_String1="choice", _String2="EXIT") returned -2 [0061.022] _wcsicmp (_String1="choice", _String2="SETLOCAL") returned -16 [0061.022] _wcsicmp (_String1="choice", _String2="ENDLOCAL") returned -2 [0061.022] _wcsicmp (_String1="choice", _String2="TITLE") returned -17 [0061.022] _wcsicmp (_String1="choice", _String2="START") returned -16 [0061.022] _wcsicmp (_String1="choice", _String2="DPATH") returned -1 [0061.022] _wcsicmp (_String1="choice", _String2="KEYS") returned -8 [0061.022] _wcsicmp (_String1="choice", _String2="MOVE") returned -10 [0061.022] _wcsicmp (_String1="choice", _String2="PUSHD") returned -13 [0061.022] _wcsicmp (_String1="choice", _String2="POPD") returned -13 [0061.022] _wcsicmp (_String1="choice", _String2="ASSOC") returned 2 [0061.022] _wcsicmp (_String1="choice", _String2="FTYPE") returned -3 [0061.022] _wcsicmp (_String1="choice", _String2="BREAK") returned 1 [0061.022] _wcsicmp (_String1="choice", _String2="COLOR") returned -7 [0061.022] _wcsicmp (_String1="choice", _String2="MKLINK") returned -10 [0061.022] _wcsicmp (_String1="choice", _String2="DIR") returned -1 [0061.022] _wcsicmp (_String1="choice", _String2="ERASE") returned -2 [0061.022] _wcsicmp (_String1="choice", _String2="DEL") returned -1 [0061.022] _wcsicmp (_String1="choice", _String2="TYPE") returned -17 [0061.022] _wcsicmp (_String1="choice", _String2="COPY") returned -7 [0061.022] _wcsicmp (_String1="choice", _String2="CD") returned 4 [0061.022] _wcsicmp (_String1="choice", _String2="CHDIR") returned 11 [0061.022] _wcsicmp (_String1="choice", _String2="RENAME") returned -15 [0061.022] _wcsicmp (_String1="choice", _String2="REN") returned -15 [0061.023] _wcsicmp (_String1="choice", _String2="ECHO") returned -2 [0061.023] _wcsicmp (_String1="choice", _String2="SET") returned -16 [0061.023] _wcsicmp (_String1="choice", _String2="PAUSE") returned -13 [0061.023] _wcsicmp (_String1="choice", _String2="DATE") returned -1 [0061.023] _wcsicmp (_String1="choice", _String2="TIME") returned -17 [0061.023] _wcsicmp (_String1="choice", _String2="PROMPT") returned -13 [0061.023] _wcsicmp (_String1="choice", _String2="MD") returned -10 [0061.023] _wcsicmp (_String1="choice", _String2="MKDIR") returned -10 [0061.023] _wcsicmp (_String1="choice", _String2="RD") returned -15 [0061.023] _wcsicmp (_String1="choice", _String2="RMDIR") returned -15 [0061.023] _wcsicmp (_String1="choice", _String2="PATH") returned -13 [0061.023] _wcsicmp (_String1="choice", _String2="GOTO") returned -4 [0061.023] _wcsicmp (_String1="choice", _String2="SHIFT") returned -16 [0061.023] _wcsicmp (_String1="choice", _String2="CLS") returned -4 [0061.023] _wcsicmp (_String1="choice", _String2="CALL") returned 7 [0061.023] _wcsicmp (_String1="choice", _String2="VERIFY") returned -19 [0061.023] _wcsicmp (_String1="choice", _String2="VER") returned -19 [0061.023] _wcsicmp (_String1="choice", _String2="VOL") returned -19 [0061.023] _wcsicmp (_String1="choice", _String2="EXIT") returned -2 [0061.023] _wcsicmp (_String1="choice", _String2="SETLOCAL") returned -16 [0061.023] _wcsicmp (_String1="choice", _String2="ENDLOCAL") returned -2 [0061.023] _wcsicmp (_String1="choice", _String2="TITLE") returned -17 [0061.023] _wcsicmp (_String1="choice", _String2="START") returned -16 [0061.023] _wcsicmp (_String1="choice", _String2="DPATH") returned -1 [0061.023] _wcsicmp (_String1="choice", _String2="KEYS") returned -8 [0061.023] _wcsicmp (_String1="choice", _String2="MOVE") returned -10 [0061.023] _wcsicmp (_String1="choice", _String2="PUSHD") returned -13 [0061.023] _wcsicmp (_String1="choice", _String2="POPD") returned -13 [0061.023] _wcsicmp (_String1="choice", _String2="ASSOC") returned 2 [0061.023] _wcsicmp (_String1="choice", _String2="FTYPE") returned -3 [0061.023] _wcsicmp (_String1="choice", _String2="BREAK") returned 1 [0061.023] _wcsicmp (_String1="choice", _String2="COLOR") returned -7 [0061.023] _wcsicmp (_String1="choice", _String2="MKLINK") returned -10 [0061.023] _wcsicmp (_String1="choice", _String2="FOR") returned -3 [0061.023] _wcsicmp (_String1="choice", _String2="IF") returned -6 [0061.023] _wcsicmp (_String1="choice", _String2="REM") returned -15 [0061.024] GetProcessHeap () returned 0x7b0000 [0061.024] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x210) returned 0x7c3330 [0061.024] GetProcessHeap () returned 0x7b0000 [0061.024] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x3e) returned 0x7c3548 [0061.024] _wcsnicmp (_String1="choi", _String2="cmd ", _MaxCount=0x4) returned -5 [0061.024] GetProcessHeap () returned 0x7b0000 [0061.024] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x418) returned 0x7b07f0 [0061.024] SetErrorMode (uMode=0x0) returned 0x0 [0061.024] SetErrorMode (uMode=0x1) returned 0x0 [0061.024] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x7b07f8, lpFilePart=0x40f418 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x40f418*="Desktop") returned 0x25 [0061.024] SetErrorMode (uMode=0x0) returned 0x1 [0061.024] GetProcessHeap () returned 0x7b0000 [0061.024] RtlReAllocateHeap (Heap=0x7b0000, Flags=0x0, Ptr=0x7b07f0, Size=0x62) returned 0x7b07f0 [0061.024] GetProcessHeap () returned 0x7b0000 [0061.024] RtlSizeHeap (HeapHandle=0x7b0000, Flags=0x0, MemoryPointer=0x7b07f0) returned 0x62 [0061.024] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a8f0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0061.024] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0061.024] GetProcessHeap () returned 0x7b0000 [0061.024] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x120) returned 0x7c3590 [0061.024] GetProcessHeap () returned 0x7b0000 [0061.024] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x238) returned 0x7b0860 [0061.030] GetProcessHeap () returned 0x7b0000 [0061.030] RtlReAllocateHeap (Heap=0x7b0000, Flags=0x0, Ptr=0x7b0860, Size=0x122) returned 0x7b0860 [0061.030] GetProcessHeap () returned 0x7b0000 [0061.030] RtlSizeHeap (HeapHandle=0x7b0000, Flags=0x0, MemoryPointer=0x7b0860) returned 0x122 [0061.030] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a8f0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0061.030] GetProcessHeap () returned 0x7b0000 [0061.030] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0xe0) returned 0x7b0990 [0061.030] GetProcessHeap () returned 0x7b0000 [0061.030] RtlReAllocateHeap (Heap=0x7b0000, Flags=0x0, Ptr=0x7b0990, Size=0x76) returned 0x7b0990 [0061.030] GetProcessHeap () returned 0x7b0000 [0061.030] RtlSizeHeap (HeapHandle=0x7b0000, Flags=0x0, MemoryPointer=0x7b0990) returned 0x76 [0061.031] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0061.031] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\choice.*", fInfoLevelId=0x1, lpFindFileData=0x40f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x40f194) returned 0xffffffff [0061.031] GetLastError () returned 0x2 [0061.031] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\choice", fInfoLevelId=0x1, lpFindFileData=0x40f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x40f194) returned 0xffffffff [0061.031] GetLastError () returned 0x2 [0061.031] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0061.031] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\choice.*", fInfoLevelId=0x1, lpFindFileData=0x40f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x40f194) returned 0x7b0a10 [0061.031] GetProcessHeap () returned 0x7b0000 [0061.031] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x14) returned 0x7b0a50 [0061.031] FindClose (in: hFindFile=0x7b0a10 | out: hFindFile=0x7b0a10) returned 1 [0061.063] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\choice.COM", fInfoLevelId=0x1, lpFindFileData=0x40f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x40f194) returned 0xffffffff [0061.063] GetLastError () returned 0x2 [0061.063] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\choice.EXE", fInfoLevelId=0x1, lpFindFileData=0x40f194, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x40f194) returned 0x7b0a10 [0061.063] GetProcessHeap () returned 0x7b0000 [0061.063] RtlReAllocateHeap (Heap=0x7b0000, Flags=0x0, Ptr=0x7b0a50, Size=0x4) returned 0x7b0a50 [0061.063] FindClose (in: hFindFile=0x7b0a10 | out: hFindFile=0x7b0a10) returned 1 [0061.063] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0061.063] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0061.063] GetConsoleTitleW (in: lpConsoleTitle=0x40f68c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0061.064] InitializeProcThreadAttributeList (in: lpAttributeList=0x40f514, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x40f5dc | out: lpAttributeList=0x40f514, lpSize=0x40f5dc) returned 1 [0061.064] UpdateProcThreadAttribute (in: lpAttributeList=0x40f514, dwFlags=0x0, Attribute=0x60001, lpValue=0x40f5d4, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x40f514, lpPreviousValue=0x0) returned 1 [0061.064] GetStartupInfoW (in: lpStartupInfo=0x40f4d0 | out: lpStartupInfo=0x40f4d0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0061.064] GetProcessHeap () returned 0x7b0000 [0061.064] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x18) returned 0x7b0a10 [0061.064] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0061.064] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0061.064] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0061.064] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0061.064] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0061.064] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0061.064] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0061.064] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0061.064] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0061.064] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0061.064] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0061.064] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0061.064] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0061.064] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0061.064] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0061.064] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0061.064] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0061.064] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0061.064] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0061.064] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0061.064] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0061.064] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0061.064] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0061.064] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0061.064] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0061.064] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0061.064] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0061.065] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0061.065] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0061.065] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0061.065] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0061.065] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0061.065] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0061.065] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0061.065] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0061.065] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0061.065] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0061.065] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0061.065] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0061.065] GetProcessHeap () returned 0x7b0000 [0061.065] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7b0a10 | out: hHeap=0x7b0000) returned 1 [0061.065] GetProcessHeap () returned 0x7b0000 [0061.065] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0xa) returned 0x7bfff0 [0061.065] lstrcmpW (lpString1="\\choice.exe", lpString2="\\XCOPY.EXE") returned -1 [0061.066] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\choice.exe", lpCommandLine="choice /C Y /N /D Y /T 3 ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x40f570*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="choice /C Y /N /D Y /T 3 ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x40f5bc | out: lpCommandLine="choice /C Y /N /D Y /T 3 ", lpProcessInformation=0x40f5bc*(hProcess=0x78, hThread=0x74, dwProcessId=0x4f0, dwThreadId=0x6a8)) returned 1 [0061.070] CloseHandle (hObject=0x74) returned 1 [0061.070] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0061.070] GetProcessHeap () returned 0x7b0000 [0061.070] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c5fc0 | out: hHeap=0x7b0000) returned 1 [0061.070] GetEnvironmentStringsW () returned 0x7c5fc0* [0061.070] GetProcessHeap () returned 0x7b0000 [0061.070] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0xb36) returned 0x7c41a0 [0061.070] FreeEnvironmentStringsW (penv=0x7c5fc0) returned 1 [0061.070] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0064.147] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x40f4b0 | out: lpExitCode=0x40f4b0*=0x1) returned 1 [0064.148] CloseHandle (hObject=0x78) returned 1 [0064.148] _vsnwprintf (in: _Buffer=0x40f5f8, _BufferCount=0x13, _Format="%08X", _ArgList=0x40f4bc | out: _Buffer="00000001") returned 8 [0064.148] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000001") returned 1 [0064.148] GetProcessHeap () returned 0x7b0000 [0064.148] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c41a0 | out: hHeap=0x7b0000) returned 1 [0064.148] GetEnvironmentStringsW () returned 0x7c41a0* [0064.148] GetProcessHeap () returned 0x7b0000 [0064.148] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0xb5c) returned 0x7c9668 [0064.148] FreeEnvironmentStringsW (penv=0x7c41a0) returned 1 [0064.148] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0064.148] GetProcessHeap () returned 0x7b0000 [0064.148] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c9668 | out: hHeap=0x7b0000) returned 1 [0064.148] GetEnvironmentStringsW () returned 0x7c41a0* [0064.148] GetProcessHeap () returned 0x7b0000 [0064.148] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0xb5c) returned 0x7c9668 [0064.148] FreeEnvironmentStringsW (penv=0x7c41a0) returned 1 [0064.148] GetProcessHeap () returned 0x7b0000 [0064.148] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bfff0 | out: hHeap=0x7b0000) returned 1 [0064.148] DeleteProcThreadAttributeList (in: lpAttributeList=0x40f514 | out: lpAttributeList=0x40f514) [0064.148] GetConsoleTitleW (in: lpConsoleTitle=0x40f8f8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0064.149] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x40e970, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x40e974, nFileSystemNameSize=0x106 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x40e970*=0xff, lpFileSystemFlags=0x0, lpFileSystemNameBuffer="NTFS") returned 1 [0064.149] _wcsicmp (_String1="NTFS", _String2="FAT") returned 8 [0064.149] GetProcessHeap () returned 0x7b0000 [0064.149] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x2c) returned 0x7bf4d8 [0064.149] GetProcessHeap () returned 0x7b0000 [0064.149] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x258) returned 0x7b0e38 [0064.149] _wcsicmp (_String1="RegAsm.exe", _String2=".") returned 68 [0064.149] _wcsicmp (_String1="RegAsm.exe", _String2="..") returned 68 [0064.149] GetFileAttributesW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\regasm.exe")) returned 0x20 [0064.149] FindFirstFileExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe", fInfoLevelId=0x0, lpFindFileData=0x7c5fcc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x7c5fcc) returned 0x7c67d0 [0064.149] DeleteFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\regasm.exe")) returned 0 [0064.149] DeleteFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\regasm.exe")) returned 0 [0064.150] GetLastError () returned 0x5 [0064.150] _vsnwprintf (in: _Buffer=0x4a8f4640, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0x40ec80 | out: _Buffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\r\n") returned 58 [0064.150] _get_osfhandle (_FileHandle=1) returned 0x7 [0064.150] GetFileType (hFile=0x7) returned 0x2 [0064.150] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0064.150] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x40ec40 | out: lpMode=0x40ec40) returned 1 [0064.150] _get_osfhandle (_FileHandle=1) returned 0x7 [0064.150] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a8f4640*, nNumberOfCharsToWrite=0x3a, lpNumberOfCharsWritten=0x40ec6c, lpReserved=0x0 | out: lpBuffer=0x4a8f4640*, lpNumberOfCharsWritten=0x40ec6c*=0x3a) returned 1 [0064.151] _get_osfhandle (_FileHandle=2) returned 0xb [0064.151] GetFileType (hFile=0xb) returned 0x2 [0064.151] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0064.151] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x40ebf4 | out: lpMode=0x40ebf4) returned 1 [0064.151] _get_osfhandle (_FileHandle=2) returned 0xb [0064.151] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x40ec28 | out: lpConsoleScreenBufferInfo=0x40ec28) returned 1 [0064.151] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x4a8f4640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Access is denied.\r\n") returned 0x13 [0064.152] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a8f4640*, nNumberOfCharsToWrite=0x13, lpNumberOfCharsWritten=0x40ec4c, lpReserved=0x0 | out: lpBuffer=0x4a8f4640*, lpNumberOfCharsWritten=0x40ec4c*=0x13) returned 1 [0064.152] FindNextFileW (in: hFindFile=0x7c67d0, lpFindFileData=0x7c5fcc | out: lpFindFileData=0x7c5fcc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x5f591240, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0xfa98, dwReserved0=0x0, dwReserved1=0x0, cFileName="RegAsm.exe", cAlternateFileName="")) returned 0 [0064.153] GetLastError () returned 0x12 [0064.153] FindClose (in: hFindFile=0x7c67d0 | out: hFindFile=0x7c67d0) returned 1 [0064.153] GetProcessHeap () returned 0x7b0000 [0064.153] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c5fc0 | out: hHeap=0x7b0000) returned 1 [0064.153] GetProcessHeap () returned 0x7b0000 [0064.153] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c2600 | out: hHeap=0x7b0000) returned 1 [0064.153] GetProcessHeap () returned 0x7b0000 [0064.153] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c5828 | out: hHeap=0x7b0000) returned 1 [0064.153] GetProcessHeap () returned 0x7b0000 [0064.153] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c2590 | out: hHeap=0x7b0000) returned 1 [0064.153] GetProcessHeap () returned 0x7b0000 [0064.153] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c2330 | out: hHeap=0x7b0000) returned 1 [0064.153] GetProcessHeap () returned 0x7b0000 [0064.153] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7b1098 | out: hHeap=0x7b0000) returned 1 [0064.153] GetProcessHeap () returned 0x7b0000 [0064.153] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7b0e38 | out: hHeap=0x7b0000) returned 1 [0064.153] GetProcessHeap () returned 0x7b0000 [0064.153] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7bf4d8 | out: hHeap=0x7b0000) returned 1 [0064.153] GetProcessHeap () returned 0x7b0000 [0064.153] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7b0af0 | out: hHeap=0x7b0000) returned 1 [0064.153] GetProcessHeap () returned 0x7b0000 [0064.153] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7b0db0 | out: hHeap=0x7b0000) returned 1 [0064.154] GetProcessHeap () returned 0x7b0000 [0064.154] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7b0d28 | out: hHeap=0x7b0000) returned 1 [0064.154] _get_osfhandle (_FileHandle=1) returned 0x7 [0064.154] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0064.154] _get_osfhandle (_FileHandle=1) returned 0x7 [0064.154] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8e41ac | out: lpMode=0x4a8e41ac) returned 1 [0064.154] _get_osfhandle (_FileHandle=0) returned 0x3 [0064.154] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8e41b0 | out: lpMode=0x4a8e41b0) returned 1 [0064.154] _get_osfhandle (_FileHandle=0) returned 0x3 [0064.154] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0064.154] SetConsoleInputExeNameW () returned 0x1 [0064.154] GetConsoleOutputCP () returned 0x1b5 [0064.155] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a8e4260 | out: lpCPInfo=0x4a8e4260) returned 1 [0064.155] SetThreadUILanguage (LangId=0x0) returned 0x409 [0064.155] exit (_Code=0) Process: id = "14" image_name = "choice.exe" filename = "c:\\windows\\syswow64\\choice.exe" page_root = "0x5d18f000" os_pid = "0x4f0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0x410" cmd_line = "choice /C Y /N /D Y /T 3 " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 120 os_tid = 0x6a8 Process: id = "15" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x8bed000" os_pid = "0x334" os_integrity_level = "0x4000" os_privileges = "0x60b16080" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x36c" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AudioEndpointBuilder" [0xe], "NT SERVICE\\CscService" [0xa], "NT SERVICE\\dot3svc" [0xa], "NT SERVICE\\hidserv" [0xa], "NT SERVICE\\HomeGroupListener" [0xa], "NT SERVICE\\IPBusEnum" [0xa], "NT SERVICE\\Netman" [0xa], "NT SERVICE\\PcaSvc" [0xa], "NT SERVICE\\StorSvc" [0xa], "NT SERVICE\\TabletInputService" [0xa], "NT SERVICE\\TrkWks" [0xa], "NT SERVICE\\UmRdpService" [0xa], "NT SERVICE\\UxSms" [0xa], "NT SERVICE\\WdiSystemHost" [0xa], "NT SERVICE\\Wlansvc" [0xa], "NT SERVICE\\WPDBusEnum" [0xa], "NT SERVICE\\wudfsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000ba6f" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 138 os_tid = 0x2ac Thread: id = 139 os_tid = 0x618 Thread: id = 140 os_tid = 0x658 Thread: id = 141 os_tid = 0x584 Thread: id = 142 os_tid = 0x728 Thread: id = 143 os_tid = 0x674 Thread: id = 144 os_tid = 0x65c Thread: id = 145 os_tid = 0x144 Thread: id = 146 os_tid = 0x118 Thread: id = 147 os_tid = 0x3ec Thread: id = 148 os_tid = 0x3e0 Thread: id = 149 os_tid = 0x3dc Thread: id = 150 os_tid = 0x3cc Thread: id = 151 os_tid = 0x3c8 Thread: id = 152 os_tid = 0x388 Thread: id = 153 os_tid = 0x384 Thread: id = 154 os_tid = 0x380 Thread: id = 155 os_tid = 0x37c Thread: id = 156 os_tid = 0x364 Thread: id = 157 os_tid = 0x360 Thread: id = 158 os_tid = 0x34c Thread: id = 159 os_tid = 0x338 Thread: id = 163 os_tid = 0x890 Process: id = "16" image_name = "vbc.exe" filename = "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\vbc.exe" page_root = "0x7b7e9000" os_pid = "0x540" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe\" e" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e1ee" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 170 os_tid = 0x544 [0115.470] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0x9d494a0, dwHighDateTime=0x1d531b2)) [0115.470] GetCurrentProcessId () returned 0x540 [0115.470] GetCurrentThreadId () returned 0x544 [0115.470] GetTickCount () returned 0x45b6 [0115.470] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=6117317463) returned 1 [0115.473] __set_app_type (_Type=0x1) [0115.473] _encode_pointer () returned 0x1986fa15 [0115.473] __p__fmode () returned 0x73184008 [0115.473] __p__commode () returned 0x731843e8 [0115.473] _controlfp_s (in: _CurrentState=0x0, _NewValue=0x10000, _Mask=0x30000 | out: _CurrentState=0x0) returned 0x0 [0115.473] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4e53d4) returned 0x0 [0115.473] _decode_pointer () returned 0xffffffff [0115.473] _onexit (_Func=0x4753f6) returned 0x4753f6 [0115.473] __wgetmainargs (in: _Argc=0x4ef6f0, _Argv=0x4ef6f8, _Env=0x4ef6f4, _DoWildCard=0, _StartInfo=0x4ef700 | out: _Argc=0x4ef6f0, _Argv=0x4ef6f8, _Env=0x4ef6f4) returned 0 [0115.474] GetVersionExA (in: lpVersionInformation=0x18fea4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x18fea4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0115.474] _decode_pointer () returned 0xffffffff [0115.474] _onexit (_Func=0x477f4e) returned 0x477f4e [0115.474] _decode_pointer () returned 0xffffffff [0115.474] _onexit (_Func=0x476a3b) returned 0x476a3b [0115.474] _decode_pointer () returned 0xffffffff [0115.474] _onexit (_Func=0x477f22) returned 0x477f22 [0115.475] _decode_pointer () returned 0xffffffff [0115.475] _onexit (_Func=0x4753e2) returned 0x4753e2 [0115.475] _decode_pointer () returned 0xffffffff [0115.475] _onexit (_Func=0x4753d5) returned 0x4753d5 [0115.475] _decode_pointer () returned 0xffffffff [0115.475] _onexit (_Func=0x4753c8) returned 0x4753c8 [0115.475] _decode_pointer () returned 0xffffffff [0115.475] _onexit (_Func=0x4753bb) returned 0x4753bb [0115.476] GetVersionExA (in: lpVersionInformation=0x18fe68*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x76edfada, dwMinorVersion=0x76f00fe2, dwBuildNumber=0xffffffff, dwPlatformId=0x24, szCSDVersion="\x88\xfe\x18") | out: lpVersionInformation=0x18fe68*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0115.476] GetConsoleOutputCP () returned 0x1b5 [0115.476] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0115.476] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7, lpConsoleScreenBufferInfo=0x18ff10 | out: lpConsoleScreenBufferInfo=0x18ff10) returned 1 [0115.477] GetCommandLineW () returned="\"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe\" e" [0115.477] LocalAlloc (uFlags=0x0, uBytes=0x74) returned 0x98f4a0 [0115.477] GetCommandLineW () returned="\"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe\" e" [0115.477] wcsncpy_s (in: _Destination=0x98f4a0, _SizeInWords=0x3a, _Source="\"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe\" e", _MaxCount=0x39 | out: _Destination="\"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe\" e") returned 0x0 [0115.477] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x996d98 [0115.477] LocalAlloc (uFlags=0x0, uBytes=0x6c) returned 0x996da8 [0115.477] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x996e20 [0115.477] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x996e30 [0115.477] GetVersionExA (in: lpVersionInformation=0x18fb10*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x118fab8, dwMinorVersion=0x76e49b42, dwBuildNumber=0x18fcb0, dwPlatformId=0x76f413d2, szCSDVersion="") | out: lpVersionInformation=0x18fb10*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0115.477] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x767f0000 [0115.478] GetProcAddress (hModule=0x767f0000, lpProcName="GetModuleFileNameW") returned 0x76804950 [0115.478] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fcec, nSize=0x104 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\vbc.exe")) returned 0x35 [0115.478] PathRemoveFileSpecW (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727") returned 1 [0115.478] PathAppendW (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727", pMore="vbc.rsp" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.rsp") returned 1 [0115.479] _waccess_s (_FileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.rsp", _AccessMode=4) returned 0x0 [0115.480] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x996e40 [0115.480] LocalAlloc (uFlags=0x0, uBytes=0x6e) returned 0x996e50 [0115.480] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x996ec8 [0115.480] GetProcAddress (hModule=0x767f0000, lpProcName="GetFullPathNameW") returned 0x768040d4 [0115.480] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.rsp", nBufferLength=0x104, lpBuffer=0x996ec8, lpFilePart=0x18feb0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.rsp", lpFilePart=0x18feb0*="vbc.rsp") returned 0x35 [0115.480] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x993c88 [0115.480] LocalAlloc (uFlags=0x0, uBytes=0x6c) returned 0x9970e0 [0115.480] GetProcAddress (hModule=0x767f0000, lpProcName="CreateFileW") returned 0x76803f5c [0115.480] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.rsp" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\vbc.rsp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x90 [0115.480] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42e [0115.480] CreateFileMappingA (hFile=0x90, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x94 [0115.480] MapViewOfFile (hFileMappingObject=0x94, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x230000 [0115.482] GetACP () returned 0x4e4 [0115.482] IsValidCodePage (CodePage=0x4e4) returned 1 [0115.482] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x230000, cbMultiByte=1070, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1070 [0115.482] GetACP () returned 0x4e4 [0115.482] IsValidCodePage (CodePage=0x4e4) returned 1 [0115.482] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x230000, cbMultiByte=1070, lpWideCharStr=0x997234, cchWideChar=1070 | out: lpWideCharStr="# This file contains command-line options that the VB\r\n# command line compiler (VBC) will process as part\r\n# of every compilation, unless the \"/noconfig\" option\r\n# is specified. \r\n\r\n# Reference the common Framework libraries\r\n/r:Accessibility.dll\r\n/r:Microsoft.Vsa.dll\r\n/r:System.Configuration.dll\r\n/r:System.Configuration.Install.dll\r\n/r:System.Data.dll\r\n/r:System.Data.OracleClient.dll\r\n/r:System.Data.SqlXml.dll\r\n/r:System.Deployment.dll\r\n/r:System.Design.dll\r\n/r:System.DirectoryServices.dll\r\n/r:System.dll\r\n/r:System.Drawing.Design.dll\r\n/r:System.Drawing.dll\r\n/r:System.EnterpriseServices.dll\r\n/r:System.Management.dll\r\n/r:System.Messaging.dll\r\n/r:System.Runtime.Remoting.dll\r\n/r:System.Runtime.Serialization.Formatters.Soap.dll\r\n/r:System.Security.dll\r\n/r:System.ServiceProcess.dll\r\n/r:System.Transactions.dll\r\n/r:System.Web.dll\r\n/r:System.Web.Mobile.dll\r\n/r:System.Web.RegularExpressions.dll\r\n/r:System.Web.Services.dll\r\n/r:System.Windows.Forms.Dll\r\n/r:System.XML.dll\r\n\r\n# Import System and Microsoft.VisualBasic\r\n/imports:System\r\n/imports:Microsoft.VisualBasic\r\n") returned 1070 [0115.482] UnmapViewOfFile (lpBaseAddress=0x230000) returned 1 [0115.482] CloseHandle (hObject=0x94) returned 1 [0115.482] CloseHandle (hObject=0x90) returned 1 [0115.482] SysStringLen (param_1="# This file contains command-line options that the VB\r\n# command line compiler (VBC) will process as part\r\n# of every compilation, unless the \"/noconfig\" option\r\n# is specified. \r\n\r\n# Reference the common Framework libraries\r\n/r:Accessibility.dll\r\n/r:Microsoft.Vsa.dll\r\n/r:System.Configuration.dll\r\n/r:System.Configuration.Install.dll\r\n/r:System.Data.dll\r\n/r:System.Data.OracleClient.dll\r\n/r:System.Data.SqlXml.dll\r\n/r:System.Deployment.dll\r\n/r:System.Design.dll\r\n/r:System.DirectoryServices.dll\r\n/r:System.dll\r\n/r:System.Drawing.Design.dll\r\n/r:System.Drawing.dll\r\n/r:System.EnterpriseServices.dll\r\n/r:System.Management.dll\r\n/r:System.Messaging.dll\r\n/r:System.Runtime.Remoting.dll\r\n/r:System.Runtime.Serialization.Formatters.Soap.dll\r\n/r:System.Security.dll\r\n/r:System.ServiceProcess.dll\r\n/r:System.Transactions.dll\r\n/r:System.Web.dll\r\n/r:System.Web.Mobile.dll\r\n/r:System.Web.RegularExpressions.dll\r\n/r:System.Web.Services.dll\r\n/r:System.Windows.Forms.Dll\r\n/r:System.XML.dll\r\n\r\n# Import System and Microsoft.VisualBasic\r\n/imports:System\r\n/imports:Microsoft.VisualBasic\r\n") returned 0x42e [0115.482] LocalAlloc (uFlags=0x0, uBytes=0x85e) returned 0x997aa8 [0115.482] SysStringLen (param_1="# This file contains command-line options that the VB\r\n# command line compiler (VBC) will process as part\r\n# of every compilation, unless the \"/noconfig\" option\r\n# is specified. \r\n\r\n# Reference the common Framework libraries\r\n/r:Accessibility.dll\r\n/r:Microsoft.Vsa.dll\r\n/r:System.Configuration.dll\r\n/r:System.Configuration.Install.dll\r\n/r:System.Data.dll\r\n/r:System.Data.OracleClient.dll\r\n/r:System.Data.SqlXml.dll\r\n/r:System.Deployment.dll\r\n/r:System.Design.dll\r\n/r:System.DirectoryServices.dll\r\n/r:System.dll\r\n/r:System.Drawing.Design.dll\r\n/r:System.Drawing.dll\r\n/r:System.EnterpriseServices.dll\r\n/r:System.Management.dll\r\n/r:System.Messaging.dll\r\n/r:System.Runtime.Remoting.dll\r\n/r:System.Runtime.Serialization.Formatters.Soap.dll\r\n/r:System.Security.dll\r\n/r:System.ServiceProcess.dll\r\n/r:System.Transactions.dll\r\n/r:System.Web.dll\r\n/r:System.Web.Mobile.dll\r\n/r:System.Web.RegularExpressions.dll\r\n/r:System.Web.Services.dll\r\n/r:System.Windows.Forms.Dll\r\n/r:System.XML.dll\r\n\r\n# Import System and Microsoft.VisualBasic\r\n/imports:System\r\n/imports:Microsoft.VisualBasic\r\n") returned 0x42e [0115.483] GetProcAddress (hModule=0x767f0000, lpProcName="ExpandEnvironmentStringsW") returned 0x76804173 [0115.483] ExpandEnvironmentStringsW (in: lpSrc="# This file contains command-line options that the VB\r\n# command line compiler (VBC) will process as part\r\n# of every compilation, unless the \"/noconfig\" option\r\n# is specified. \r\n\r\n# Reference the common Framework libraries\r\n/r:Accessibility.dll\r\n/r:Microsoft.Vsa.dll\r\n/r:System.Configuration.dll\r\n/r:System.Configuration.Install.dll\r\n/r:System.Data.dll\r\n/r:System.Data.OracleClient.dll\r\n/r:System.Data.SqlXml.dll\r\n/r:System.Deployment.dll\r\n/r:System.Design.dll\r\n/r:System.DirectoryServices.dll\r\n/r:System.dll\r\n/r:System.Drawing.Design.dll\r\n/r:System.Drawing.dll\r\n/r:System.EnterpriseServices.dll\r\n/r:System.Management.dll\r\n/r:System.Messaging.dll\r\n/r:System.Runtime.Remoting.dll\r\n/r:System.Runtime.Serialization.Formatters.Soap.dll\r\n/r:System.Security.dll\r\n/r:System.ServiceProcess.dll\r\n/r:System.Transactions.dll\r\n/r:System.Web.dll\r\n/r:System.Web.Mobile.dll\r\n/r:System.Web.RegularExpressions.dll\r\n/r:System.Web.Services.dll\r\n/r:System.Windows.Forms.Dll\r\n/r:System.XML.dll\r\n\r\n# Import System and Microsoft.VisualBasic\r\n/imports:System\r\n/imports:Microsoft.VisualBasic\r\n", lpDst=0x0, nSize=0x0 | out: lpDst=0x0) returned 0x42f [0115.483] LocalAlloc (uFlags=0x0, uBytes=0x85e) returned 0x998310 [0115.483] ExpandEnvironmentStringsW (in: lpSrc="# This file contains command-line options that the VB\r\n# command line compiler (VBC) will process as part\r\n# of every compilation, unless the \"/noconfig\" option\r\n# is specified. \r\n\r\n# Reference the common Framework libraries\r\n/r:Accessibility.dll\r\n/r:Microsoft.Vsa.dll\r\n/r:System.Configuration.dll\r\n/r:System.Configuration.Install.dll\r\n/r:System.Data.dll\r\n/r:System.Data.OracleClient.dll\r\n/r:System.Data.SqlXml.dll\r\n/r:System.Deployment.dll\r\n/r:System.Design.dll\r\n/r:System.DirectoryServices.dll\r\n/r:System.dll\r\n/r:System.Drawing.Design.dll\r\n/r:System.Drawing.dll\r\n/r:System.EnterpriseServices.dll\r\n/r:System.Management.dll\r\n/r:System.Messaging.dll\r\n/r:System.Runtime.Remoting.dll\r\n/r:System.Runtime.Serialization.Formatters.Soap.dll\r\n/r:System.Security.dll\r\n/r:System.ServiceProcess.dll\r\n/r:System.Transactions.dll\r\n/r:System.Web.dll\r\n/r:System.Web.Mobile.dll\r\n/r:System.Web.RegularExpressions.dll\r\n/r:System.Web.Services.dll\r\n/r:System.Windows.Forms.Dll\r\n/r:System.XML.dll\r\n\r\n# Import System and Microsoft.VisualBasic\r\n/imports:System\r\n/imports:Microsoft.VisualBasic\r\n", lpDst=0x998310, nSize=0x42f | out: lpDst="# This file contains command-line options that the VB\r\n# command line compiler (VBC) will process as part\r\n# of every compilation, unless the \"/noconfig\" option\r\n# is specified. \r\n\r\n# Reference the common Framework libraries\r\n/r:Accessibility.dll\r\n/r:Microsoft.Vsa.dll\r\n/r:System.Configuration.dll\r\n/r:System.Configuration.Install.dll\r\n/r:System.Data.dll\r\n/r:System.Data.OracleClient.dll\r\n/r:System.Data.SqlXml.dll\r\n/r:System.Deployment.dll\r\n/r:System.Design.dll\r\n/r:System.DirectoryServices.dll\r\n/r:System.dll\r\n/r:System.Drawing.Design.dll\r\n/r:System.Drawing.dll\r\n/r:System.EnterpriseServices.dll\r\n/r:System.Management.dll\r\n/r:System.Messaging.dll\r\n/r:System.Runtime.Remoting.dll\r\n/r:System.Runtime.Serialization.Formatters.Soap.dll\r\n/r:System.Security.dll\r\n/r:System.ServiceProcess.dll\r\n/r:System.Transactions.dll\r\n/r:System.Web.dll\r\n/r:System.Web.Mobile.dll\r\n/r:System.Web.RegularExpressions.dll\r\n/r:System.Web.Services.dll\r\n/r:System.Windows.Forms.Dll\r\n/r:System.XML.dll\r\n\r\n# Import System and Microsoft.VisualBasic\r\n/imports:System\r\n/imports:Microsoft.VisualBasic\r\n") returned 0x42f [0115.483] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998b78 [0115.483] LocalAlloc (uFlags=0x0, uBytes=0x2a) returned 0x998b88 [0115.483] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998bc0 [0115.483] LocalAlloc (uFlags=0x0, uBytes=0x2a) returned 0x998bd0 [0115.483] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998c08 [0115.483] LocalAlloc (uFlags=0x0, uBytes=0x38) returned 0x998c18 [0115.483] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998c58 [0115.483] LocalAlloc (uFlags=0x0, uBytes=0x48) returned 0x998c68 [0115.483] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998cb8 [0115.483] LocalAlloc (uFlags=0x0, uBytes=0x26) returned 0x998cc8 [0115.483] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998cf8 [0115.483] LocalAlloc (uFlags=0x0, uBytes=0x40) returned 0x994ad8 [0115.483] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998d08 [0115.483] LocalAlloc (uFlags=0x0, uBytes=0x34) returned 0x998d18 [0115.483] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998d58 [0115.483] LocalAlloc (uFlags=0x0, uBytes=0x32) returned 0x998d68 [0115.483] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998da8 [0115.483] LocalAlloc (uFlags=0x0, uBytes=0x2a) returned 0x998db8 [0115.483] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998e08 [0115.484] LocalAlloc (uFlags=0x0, uBytes=0x40) returned 0x994b20 [0115.484] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998e18 [0115.484] LocalAlloc (uFlags=0x0, uBytes=0x1c) returned 0x996348 [0115.484] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998e28 [0115.484] LocalAlloc (uFlags=0x0, uBytes=0x3a) returned 0x994b68 [0115.484] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998e38 [0115.484] LocalAlloc (uFlags=0x0, uBytes=0x2c) returned 0x9991f0 [0115.484] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998e48 [0115.484] LocalAlloc (uFlags=0x0, uBytes=0x42) returned 0x999228 [0115.484] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998e58 [0115.484] LocalAlloc (uFlags=0x0, uBytes=0x32) returned 0x999278 [0115.484] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998e68 [0115.484] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x9992b8 [0115.484] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998e78 [0115.484] LocalAlloc (uFlags=0x0, uBytes=0x3e) returned 0x994bb0 [0115.484] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998e88 [0115.484] LocalAlloc (uFlags=0x0, uBytes=0x68) returned 0x9992f0 [0115.484] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998e98 [0115.484] LocalAlloc (uFlags=0x0, uBytes=0x2e) returned 0x999360 [0115.484] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998ea8 [0115.484] LocalAlloc (uFlags=0x0, uBytes=0x3a) returned 0x994bf8 [0115.484] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998eb8 [0115.484] LocalAlloc (uFlags=0x0, uBytes=0x36) returned 0x999398 [0115.484] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998ec8 [0115.484] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x9993d8 [0115.484] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998ed8 [0115.484] LocalAlloc (uFlags=0x0, uBytes=0x32) returned 0x999408 [0115.484] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998ee8 [0115.484] LocalAlloc (uFlags=0x0, uBytes=0x4a) returned 0x999448 [0115.485] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998ef8 [0115.485] LocalAlloc (uFlags=0x0, uBytes=0x36) returned 0x9994a0 [0115.485] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998f08 [0115.485] LocalAlloc (uFlags=0x0, uBytes=0x38) returned 0x9994e0 [0115.485] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998f18 [0115.485] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x999520 [0115.485] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998f28 [0115.485] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x996370 [0115.485] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x998f38 [0115.485] LocalAlloc (uFlags=0x0, uBytes=0x3e) returned 0x994c40 [0115.485] LocalFree (hMem=0x997aa8) returned 0x0 [0115.485] LocalFree (hMem=0x996e50) returned 0x0 [0115.485] LocalFree (hMem=0x998310) returned 0x0 [0115.485] LocalFree (hMem=0x996ec8) returned 0x0 [0115.485] LocalFree (hMem=0x9970e0) returned 0x0 [0115.485] LocalFree (hMem=0x993c88) returned 0x0 [0115.485] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x996e50 [0115.485] LocalAlloc (uFlags=0x0, uBytes=0x28) returned 0x996ed8 [0115.486] _wcslwr_s (in: _String="r:Accessibility.dll", _SizeInWords=0x14 | out: _String="r:accessibility.dll") returned 0x0 [0115.486] wcstok_s (in: _String="r:accessibility.dll", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="r", _Context=0x18feac*="accessibility.dll") returned="r" [0115.486] LocalFree (hMem=0x996ed8) returned 0x0 [0115.486] LocalAlloc (uFlags=0x0, uBytes=0x28) returned 0x996ed8 [0115.486] _wcslwr_s (in: _String="r:Microsoft.Vsa.dll", _SizeInWords=0x14 | out: _String="r:microsoft.vsa.dll") returned 0x0 [0115.486] wcstok_s (in: _String="r:microsoft.vsa.dll", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="r", _Context=0x18feac*="microsoft.vsa.dll") returned="r" [0115.486] LocalFree (hMem=0x996ed8) returned 0x0 [0115.486] LocalAlloc (uFlags=0x0, uBytes=0x36) returned 0x996ed8 [0115.486] _wcslwr_s (in: _String="r:System.Configuration.dll", _SizeInWords=0x1b | out: _String="r:system.configuration.dll") returned 0x0 [0115.486] wcstok_s (in: _String="r:system.configuration.dll", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="r", _Context=0x18feac*="system.configuration.dll") returned="r" [0115.486] LocalFree (hMem=0x996ed8) returned 0x0 [0115.486] LocalAlloc (uFlags=0x0, uBytes=0x46) returned 0x996ed8 [0115.486] _wcslwr_s (in: _String="r:System.Configuration.Install.dll", _SizeInWords=0x23 | out: _String="r:system.configuration.install.dll") returned 0x0 [0115.486] wcstok_s (in: _String="r:system.configuration.install.dll", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="r", _Context=0x18feac*="system.configuration.install.dll") returned="r" [0115.486] LocalFree (hMem=0x996ed8) returned 0x0 [0115.486] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x996ed8 [0115.486] _wcslwr_s (in: _String="r:System.Data.dll", _SizeInWords=0x12 | out: _String="r:system.data.dll") returned 0x0 [0115.486] wcstok_s (in: _String="r:system.data.dll", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="r", _Context=0x18feac*="system.data.dll") returned="r" [0115.486] LocalFree (hMem=0x996ed8) returned 0x0 [0115.486] LocalAlloc (uFlags=0x0, uBytes=0x3e) returned 0x994c88 [0115.487] _wcslwr_s (in: _String="r:System.Data.OracleClient.dll", _SizeInWords=0x1f | out: _String="r:system.data.oracleclient.dll") returned 0x0 [0115.487] wcstok_s (in: _String="r:system.data.oracleclient.dll", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="r", _Context=0x18feac*="system.data.oracleclient.dll") returned="r" [0115.487] LocalFree (hMem=0x994c88) returned 0x0 [0115.487] LocalAlloc (uFlags=0x0, uBytes=0x32) returned 0x996ed8 [0115.487] _wcslwr_s (in: _String="r:System.Data.SqlXml.dll", _SizeInWords=0x19 | out: _String="r:system.data.sqlxml.dll") returned 0x0 [0115.487] wcstok_s (in: _String="r:system.data.sqlxml.dll", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="r", _Context=0x18feac*="system.data.sqlxml.dll") returned="r" [0115.487] LocalFree (hMem=0x996ed8) returned 0x0 [0115.487] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x996ed8 [0115.487] _wcslwr_s (in: _String="r:System.Deployment.dll", _SizeInWords=0x18 | out: _String="r:system.deployment.dll") returned 0x0 [0115.487] wcstok_s (in: _String="r:system.deployment.dll", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="r", _Context=0x18feac*="system.deployment.dll") returned="r" [0115.487] LocalFree (hMem=0x996ed8) returned 0x0 [0115.487] LocalAlloc (uFlags=0x0, uBytes=0x28) returned 0x996ed8 [0115.487] _wcslwr_s (in: _String="r:System.Design.dll", _SizeInWords=0x14 | out: _String="r:system.design.dll") returned 0x0 [0115.487] wcstok_s (in: _String="r:system.design.dll", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="r", _Context=0x18feac*="system.design.dll") returned="r" [0115.487] LocalFree (hMem=0x996ed8) returned 0x0 [0115.487] LocalAlloc (uFlags=0x0, uBytes=0x3e) returned 0x994c88 [0115.487] _wcslwr_s (in: _String="r:System.DirectoryServices.dll", _SizeInWords=0x1f | out: _String="r:system.directoryservices.dll") returned 0x0 [0115.487] wcstok_s (in: _String="r:system.directoryservices.dll", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="r", _Context=0x18feac*="system.directoryservices.dll") returned="r" [0115.487] LocalFree (hMem=0x994c88) returned 0x0 [0115.487] LocalAlloc (uFlags=0x0, uBytes=0x1a) returned 0x996398 [0115.487] _wcslwr_s (in: _String="r:System.dll", _SizeInWords=0xd | out: _String="r:system.dll") returned 0x0 [0115.487] wcstok_s (in: _String="r:system.dll", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="r", _Context=0x18feac*="system.dll") returned="r" [0115.487] LocalFree (hMem=0x996398) returned 0x0 [0115.487] LocalAlloc (uFlags=0x0, uBytes=0x38) returned 0x996ed8 [0115.487] _wcslwr_s (in: _String="r:System.Drawing.Design.dll", _SizeInWords=0x1c | out: _String="r:system.drawing.design.dll") returned 0x0 [0115.487] wcstok_s (in: _String="r:system.drawing.design.dll", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="r", _Context=0x18feac*="system.drawing.design.dll") returned="r" [0115.487] LocalFree (hMem=0x996ed8) returned 0x0 [0115.487] LocalAlloc (uFlags=0x0, uBytes=0x2a) returned 0x996ed8 [0115.487] _wcslwr_s (in: _String="r:System.Drawing.dll", _SizeInWords=0x15 | out: _String="r:system.drawing.dll") returned 0x0 [0115.487] wcstok_s (in: _String="r:system.drawing.dll", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="r", _Context=0x18feac*="system.drawing.dll") returned="r" [0115.487] LocalFree (hMem=0x996ed8) returned 0x0 [0115.487] LocalAlloc (uFlags=0x0, uBytes=0x40) returned 0x994c88 [0115.487] _wcslwr_s (in: _String="r:System.EnterpriseServices.dll", _SizeInWords=0x20 | out: _String="r:system.enterpriseservices.dll") returned 0x0 [0115.487] wcstok_s (in: _String="r:system.enterpriseservices.dll", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="r", _Context=0x18feac*="system.enterpriseservices.dll") returned="r" [0115.487] LocalFree (hMem=0x994c88) returned 0x0 [0115.487] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x996ed8 [0115.487] _wcslwr_s (in: _String="r:System.Management.dll", _SizeInWords=0x18 | out: _String="r:system.management.dll") returned 0x0 [0115.488] wcstok_s (in: _String="r:system.management.dll", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="r", _Context=0x18feac*="system.management.dll") returned="r" [0115.488] LocalFree (hMem=0x996ed8) returned 0x0 [0115.488] LocalAlloc (uFlags=0x0, uBytes=0x2e) returned 0x996ed8 [0115.488] _wcslwr_s (in: _String="r:System.Messaging.dll", _SizeInWords=0x17 | out: _String="r:system.messaging.dll") returned 0x0 [0115.488] wcstok_s (in: _String="r:system.messaging.dll", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="r", _Context=0x18feac*="system.messaging.dll") returned="r" [0115.488] LocalFree (hMem=0x996ed8) returned 0x0 [0115.488] LocalAlloc (uFlags=0x0, uBytes=0x3c) returned 0x994c88 [0115.488] _wcslwr_s (in: _String="r:System.Runtime.Remoting.dll", _SizeInWords=0x1e | out: _String="r:system.runtime.remoting.dll") returned 0x0 [0115.488] wcstok_s (in: _String="r:system.runtime.remoting.dll", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="r", _Context=0x18feac*="system.runtime.remoting.dll") returned="r" [0115.488] LocalFree (hMem=0x994c88) returned 0x0 [0115.488] LocalAlloc (uFlags=0x0, uBytes=0x66) returned 0x996ed8 [0115.488] _wcslwr_s (in: _String="r:System.Runtime.Serialization.Formatters.Soap.dll", _SizeInWords=0x33 | out: _String="r:system.runtime.serialization.formatters.soap.dll") returned 0x0 [0115.488] wcstok_s (in: _String="r:system.runtime.serialization.formatters.soap.dll", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="r", _Context=0x18feac*="system.runtime.serialization.formatters.soap.dll") returned="r" [0115.488] LocalFree (hMem=0x996ed8) returned 0x0 [0115.488] LocalAlloc (uFlags=0x0, uBytes=0x2c) returned 0x996ed8 [0115.488] _wcslwr_s (in: _String="r:System.Security.dll", _SizeInWords=0x16 | out: _String="r:system.security.dll") returned 0x0 [0115.488] wcstok_s (in: _String="r:system.security.dll", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="r", _Context=0x18feac*="system.security.dll") returned="r" [0115.488] LocalFree (hMem=0x996ed8) returned 0x0 [0115.488] LocalAlloc (uFlags=0x0, uBytes=0x38) returned 0x996ed8 [0115.488] _wcslwr_s (in: _String="r:System.ServiceProcess.dll", _SizeInWords=0x1c | out: _String="r:system.serviceprocess.dll") returned 0x0 [0115.488] wcstok_s (in: _String="r:system.serviceprocess.dll", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="r", _Context=0x18feac*="system.serviceprocess.dll") returned="r" [0115.488] LocalFree (hMem=0x996ed8) returned 0x0 [0115.488] LocalAlloc (uFlags=0x0, uBytes=0x34) returned 0x996ed8 [0115.488] _wcslwr_s (in: _String="r:System.Transactions.dll", _SizeInWords=0x1a | out: _String="r:system.transactions.dll") returned 0x0 [0115.488] wcstok_s (in: _String="r:system.transactions.dll", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="r", _Context=0x18feac*="system.transactions.dll") returned="r" [0115.488] LocalFree (hMem=0x996ed8) returned 0x0 [0115.488] LocalAlloc (uFlags=0x0, uBytes=0x22) returned 0x996ed8 [0115.488] _wcslwr_s (in: _String="r:System.Web.dll", _SizeInWords=0x11 | out: _String="r:system.web.dll") returned 0x0 [0115.488] wcstok_s (in: _String="r:system.web.dll", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="r", _Context=0x18feac*="system.web.dll") returned="r" [0115.488] LocalFree (hMem=0x996ed8) returned 0x0 [0115.488] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x996ed8 [0115.488] _wcslwr_s (in: _String="r:System.Web.Mobile.dll", _SizeInWords=0x18 | out: _String="r:system.web.mobile.dll") returned 0x0 [0115.488] wcstok_s (in: _String="r:system.web.mobile.dll", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="r", _Context=0x18feac*="system.web.mobile.dll") returned="r" [0115.488] LocalFree (hMem=0x996ed8) returned 0x0 [0115.488] LocalAlloc (uFlags=0x0, uBytes=0x48) returned 0x996ed8 [0115.488] _wcslwr_s (in: _String="r:System.Web.RegularExpressions.dll", _SizeInWords=0x24 | out: _String="r:system.web.regularexpressions.dll") returned 0x0 [0115.488] wcstok_s (in: _String="r:system.web.regularexpressions.dll", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="r", _Context=0x18feac*="system.web.regularexpressions.dll") returned="r" [0115.488] LocalFree (hMem=0x996ed8) returned 0x0 [0115.489] LocalAlloc (uFlags=0x0, uBytes=0x34) returned 0x996ed8 [0115.489] _wcslwr_s (in: _String="r:System.Web.Services.dll", _SizeInWords=0x1a | out: _String="r:system.web.services.dll") returned 0x0 [0115.489] wcstok_s (in: _String="r:system.web.services.dll", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="r", _Context=0x18feac*="system.web.services.dll") returned="r" [0115.489] LocalFree (hMem=0x996ed8) returned 0x0 [0115.489] LocalAlloc (uFlags=0x0, uBytes=0x36) returned 0x996ed8 [0115.489] _wcslwr_s (in: _String="r:System.Windows.Forms.Dll", _SizeInWords=0x1b | out: _String="r:system.windows.forms.dll") returned 0x0 [0115.489] wcstok_s (in: _String="r:system.windows.forms.dll", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="r", _Context=0x18feac*="system.windows.forms.dll") returned="r" [0115.489] LocalFree (hMem=0x996ed8) returned 0x0 [0115.489] LocalAlloc (uFlags=0x0, uBytes=0x22) returned 0x996ed8 [0115.489] _wcslwr_s (in: _String="r:System.XML.dll", _SizeInWords=0x11 | out: _String="r:system.xml.dll") returned 0x0 [0115.489] wcstok_s (in: _String="r:system.xml.dll", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="r", _Context=0x18feac*="system.xml.dll") returned="r" [0115.489] LocalFree (hMem=0x996ed8) returned 0x0 [0115.489] LocalAlloc (uFlags=0x0, uBytes=0x1e) returned 0x996398 [0115.489] _wcslwr_s (in: _String="imports:System", _SizeInWords=0xf | out: _String="imports:system") returned 0x0 [0115.489] wcstok_s (in: _String="imports:system", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="imports", _Context=0x18feac*="system") returned="imports" [0115.489] LocalFree (hMem=0x996398) returned 0x0 [0115.489] LocalAlloc (uFlags=0x0, uBytes=0x3c) returned 0x994c88 [0115.489] _wcslwr_s (in: _String="imports:Microsoft.VisualBasic", _SizeInWords=0x1e | out: _String="imports:microsoft.visualbasic") returned 0x0 [0115.489] wcstok_s (in: _String="imports:microsoft.visualbasic", _Delimiter=":+-", _Context=0x18feac*=0x0 | out: _String="imports", _Context=0x18feac*="microsoft.visualbasic") returned="imports" [0115.489] LocalFree (hMem=0x994c88) returned 0x0 [0115.489] LocalAlloc (uFlags=0x0, uBytes=0x208) returned 0x996ed8 [0115.489] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x996ed8, nSize=0x103 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\vbc.exe")) returned 0x35 [0115.489] GetProcAddress (hModule=0x767f0000, lpProcName="GetModuleHandleW") returned 0x768034b0 [0115.489] GetModuleHandleW (lpModuleName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe") returned 0x400000 [0115.627] LoadLibraryA (lpLibFileName="version.dll") returned 0x72850000 [0115.628] GetProcAddress (hModule=0x72850000, lpProcName="GetFileVersionInfoSizeW") returned 0x728519d9 [0115.628] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe", lpdwHandle=0x18fac8 | out: lpdwHandle=0x18fac8) returned 0x6cc [0115.629] LocalAlloc (uFlags=0x0, uBytes=0x6cc) returned 0x999550 [0115.629] GetProcAddress (hModule=0x72850000, lpProcName="GetFileVersionInfoW") returned 0x728519f4 [0115.629] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe", dwHandle=0x0, dwLen=0x6cc, lpData=0x999550 | out: lpData=0x999550) returned 1 [0115.629] GetProcAddress (hModule=0x72850000, lpProcName="VerQueryValueW") returned 0x72851b51 [0115.629] VerQueryValueW (in: pBlock=0x999550, lpSubBlock="\\", lplpBuffer=0x18facc, puLen=0x18fad0 | out: lplpBuffer=0x18facc*=0x999578, puLen=0x18fad0) returned 1 [0115.629] _vsnwprintf_s (in: _Buffer=0x18fcf8, _BufferCount=0x80, _MaxCount=0x7f, _Format="%d.%d.%04d.%d", _ArgList=0x18faac | out: _Buffer="8.0.50727.5420") returned 14 [0115.629] LocalFree (hMem=0x999550) returned 0x0 [0115.629] LocalFree (hMem=0x996ed8) returned 0x0 [0116.784] LocalAlloc (uFlags=0x0, uBytes=0x208) returned 0x99c740 [0116.784] GetModuleFileNameW (in: hModule=0x72200000, lpFilename=0x99c740, nSize=0x103 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorwks.dll")) returned 0x3a [0116.785] GetModuleHandleW (lpModuleName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll") returned 0x72200000 [0116.785] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll", lpdwHandle=0x18fac8 | out: lpdwHandle=0x18fac8) returned 0x814 [0116.785] LocalAlloc (uFlags=0x0, uBytes=0x814) returned 0x99c950 [0116.785] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll", dwHandle=0x0, dwLen=0x814, lpData=0x99c950 | out: lpData=0x99c950) returned 1 [0116.785] VerQueryValueW (in: pBlock=0x99c950, lpSubBlock="\\", lplpBuffer=0x18facc, puLen=0x18fad0 | out: lplpBuffer=0x18facc*=0x99c978, puLen=0x18fad0) returned 1 [0116.785] _vsnwprintf_s (in: _Buffer=0x18fdf8, _BufferCount=0x80, _MaxCount=0x7f, _Format="%d.%d.%04d.%d", _ArgList=0x18faac | out: _Buffer="2.0.50727.5420") returned 14 [0116.785] LocalFree (hMem=0x99c950) returned 0x0 [0116.785] LocalFree (hMem=0x99c740) returned 0x0 [0116.785] FreeLibrary (hLibModule=0x72200000) returned 1 [0116.796] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18d0a8, nSize=0x104 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\vbc.exe")) returned 0x35 [0116.796] GetProcAddress (hModule=0x767f0000, lpProcName="LoadLibraryW") returned 0x7680492b [0116.796] LoadLibraryW (lpLibFileName="Kernel32.dll") returned 0x767f0000 [0116.796] GetProcAddress (hModule=0x767f0000, lpProcName="GetUserDefaultUILanguage") returned 0x768044ab [0116.796] FreeLibrary (hLibModule=0x767f0000) returned 1 [0116.796] GetUserDefaultUILanguage () returned 0x409 [0116.796] GetUserDefaultLCID () returned 0x409 [0116.797] GetSystemDefaultLCID () returned 0x409 [0116.797] ConvertDefaultLocale (Locale=0x9) returned 0x409 [0116.797] GetConsoleOutputCP () returned 0x1b5 [0116.797] _vsnwprintf_s (in: _Buffer=0x18c108, _BufferCount=0x7d0, _MaxCount=0x7cf, _Format="%s%u\\%s", _ArgList=0x18b6a0 | out: _Buffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\1033\\VBC7ui.dll") returned 61 [0116.797] GetProcAddress (hModule=0x767f0000, lpProcName="GetFileAttributesW") returned 0x76801b18 [0116.797] GetFileAttributesW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\1033\\VBC7ui.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\1033\\vbc7ui.dll")) returned 0x20 [0116.799] GetProcAddress (hModule=0x767f0000, lpProcName="LoadLibraryExW") returned 0x7680495d [0116.799] LoadLibraryExW (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\1033\\VBC7ui.dll", hFile=0x0, dwFlags=0x2) returned 0x230001 [0116.805] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f60000 [0116.806] GetProcAddress (hModule=0x74f60000, lpProcName="LoadStringW") returned 0x74f78eb9 [0116.806] LoadStringW (in: hInstance=0x230001, uID=0x2711, lpBuffer=0x18d2d8, cchBufferMax=512 | out: lpBuffer="Microsoft (R) Visual Basic Compiler version %s\n") returned 0x2f [0116.807] _vsnwprintf_s (in: _Buffer=0x18dad8, _BufferCount=0x1000, _MaxCount=0xfff, _Format="Microsoft (R) Visual Basic Compiler version %s\n", _ArgList=0x18fae8 | out: _Buffer="Microsoft (R) Visual Basic Compiler version 8.0.50727.5420\n") returned 59 [0116.807] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0116.807] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft (R) Visual Basic Compiler version 8.0.50727.5420\n", cchWideChar=59, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 59 [0116.807] LocalAlloc (uFlags=0x0, uBytes=0x3b) returned 0x994da8 [0116.807] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft (R) Visual Basic Compiler version 8.0.50727.5420\n", cchWideChar=59, lpMultiByteStr=0x994da8, cbMultiByte=59, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft (R) Visual Basic Compiler version 8.0.50727.5420\n", lpUsedDefaultChar=0x0) returned 59 [0116.807] WriteFile (in: hFile=0x7, lpBuffer=0x994da8*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x18d2b8, lpOverlapped=0x0 | out: lpBuffer=0x994da8*, lpNumberOfBytesWritten=0x18d2b8*=0x3b, lpOverlapped=0x0) returned 1 [0116.808] LocalFree (hMem=0x994da8) returned 0x0 [0116.808] LoadStringW (in: hInstance=0x230001, uID=0x2712, lpBuffer=0x18d2d0, cchBufferMax=512 | out: lpBuffer="for Microsoft (R) .NET Framework version %s\n") returned 0x2c [0116.808] _vsnwprintf_s (in: _Buffer=0x18dad0, _BufferCount=0x1000, _MaxCount=0xfff, _Format="for Microsoft (R) .NET Framework version %s\n", _ArgList=0x18fae0 | out: _Buffer="for Microsoft (R) .NET Framework version 2.0.50727.5420\n") returned 56 [0116.808] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0116.808] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="for Microsoft (R) .NET Framework version 2.0.50727.5420\n", cchWideChar=56, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 56 [0116.808] LocalAlloc (uFlags=0x0, uBytes=0x38) returned 0x99bf58 [0116.808] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="for Microsoft (R) .NET Framework version 2.0.50727.5420\n", cchWideChar=56, lpMultiByteStr=0x99bf58, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="for Microsoft (R) .NET Framework version 2.0.50727.5420\n&^\x9cD°¡", lpUsedDefaultChar=0x0) returned 56 [0116.808] WriteFile (in: hFile=0x7, lpBuffer=0x99bf58*, nNumberOfBytesToWrite=0x38, lpNumberOfBytesWritten=0x18d2b0, lpOverlapped=0x0 | out: lpBuffer=0x99bf58*, lpNumberOfBytesWritten=0x18d2b0*=0x38, lpOverlapped=0x0) returned 1 [0116.809] LocalFree (hMem=0x99bf58) returned 0x0 [0116.809] LoadStringW (in: hInstance=0x230001, uID=0x2713, lpBuffer=0x18d2cc, cchBufferMax=512 | out: lpBuffer="Copyright (c) Microsoft Corporation. All rights reserved.\n") returned 0x3b [0116.809] _vsnwprintf_s (in: _Buffer=0x18dacc, _BufferCount=0x1000, _MaxCount=0xfff, _Format="Copyright (c) Microsoft Corporation. All rights reserved.\n", _ArgList=0x18fadc | out: _Buffer="Copyright (c) Microsoft Corporation. All rights reserved.\n") returned 59 [0116.809] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0116.809] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) Microsoft Corporation. All rights reserved.\n", cchWideChar=59, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 59 [0116.809] LocalAlloc (uFlags=0x0, uBytes=0x3b) returned 0x994da8 [0116.809] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) Microsoft Corporation. All rights reserved.\n", cchWideChar=59, lpMultiByteStr=0x994da8, cbMultiByte=59, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) Microsoft Corporation. All rights reserved.\n", lpUsedDefaultChar=0x0) returned 59 [0116.809] WriteFile (in: hFile=0x7, lpBuffer=0x994da8*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x18d2ac, lpOverlapped=0x0 | out: lpBuffer=0x994da8*, lpNumberOfBytesWritten=0x18d2ac*=0x3b, lpOverlapped=0x0) returned 1 [0116.811] LocalFree (hMem=0x994da8) returned 0x0 [0116.811] _vsnwprintf_s (in: _Buffer=0x18dae4, _BufferCount=0x1000, _MaxCount=0xfff, _Format="\n", _ArgList=0x18faf4 | out: _Buffer="\n") returned 1 [0116.811] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0116.811] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0116.811] LocalAlloc (uFlags=0x0, uBytes=0x1) returned 0x998f58 [0116.811] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x998f58, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\n", lpUsedDefaultChar=0x0) returned 1 [0116.811] WriteFile (in: hFile=0x7, lpBuffer=0x998f58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18dac4, lpOverlapped=0x0 | out: lpBuffer=0x998f58*, lpNumberOfBytesWritten=0x18dac4*=0x1, lpOverlapped=0x0) returned 1 [0116.811] LocalFree (hMem=0x998f58) returned 0x0 [0116.811] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0116.812] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0116.813] ??2@YAPAXI@Z () returned 0xc43d68 [0116.813] CoTaskMemAlloc (cb=0x988) returned 0x9a3340 [0116.813] HeapCreate (flOptions=0x5, dwInitialSize=0x0, dwMaximumSize=0x0) returned 0x360000 [0116.814] CoTaskMemAlloc (cb=0x1) returned 0x998fc8 [0116.814] GetSystemInfo (in: lpSystemInfo=0x18fb0c | out: lpSystemInfo=0x18fb0c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0116.814] CoTaskMemAlloc (cb=0x34) returned 0x99bf58 [0116.814] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x1000) returned 0x360578 [0116.814] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x1000) returned 0x361580 [0116.814] CoTaskMemAlloc (cb=0x8) returned 0x998fa8 [0116.814] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x1c) returned 0x362588 [0116.814] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x260000 [0116.815] VirtualAlloc (lpAddress=0x260000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x260000 [0116.815] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x1c) returned 0x3625b0 [0116.815] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x2b0000 [0116.816] VirtualAlloc (lpAddress=0x2b0000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x2b0000 [0116.816] VirtualAlloc (lpAddress=0x2b1000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x2b1000 [0116.816] VirtualAlloc (lpAddress=0x2b2000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x2b2000 [0116.817] VirtualAlloc (lpAddress=0x2b3000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x2b3000 [0116.817] VirtualAlloc (lpAddress=0x2b4000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x2b4000 [0116.817] VirtualAlloc (lpAddress=0x2b5000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x2b5000 [0116.817] VirtualAlloc (lpAddress=0x2b6000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x2b6000 [0116.817] VirtualAlloc (lpAddress=0x2b7000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x2b7000 [0116.820] VirtualAlloc (lpAddress=0x2b8000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x2b8000 [0116.820] VirtualAlloc (lpAddress=0x2b9000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x2b9000 [0116.855] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0116.855] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x230) returned 0x3625d8 [0116.856] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x99ef60 [0116.857] LocalFree (hMem=0x99ef60) returned 0x0 [0116.857] wcscpy_s (in: _Destination=0x18fd88, _SizeInWords=0x2f, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned 0x0 [0116.857] wcstok_s (in: _String="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", _Delimiter=";", _Context=0x18faa8*=0x0 | out: _String="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", _Context=0x18faa8*="") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0116.857] CoTaskMemAlloc (cb=0x7a) returned 0x998a60 [0116.857] wcscpy_s (in: _Destination=0x998a60, _SizeInWords=0x3d, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned 0x0 [0116.857] wcscat_s (in: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", _SizeInWords=0x3d, _Source="mscorlib.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll") returned 0x0 [0116.857] GetProcAddress (hModule=0x767f0000, lpProcName="FindFirstFileW") returned 0x76804435 [0116.857] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", lpFindFileData=0x18fac0 | out: lpFindFileData=0x18fac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f3afa84, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f3afa84, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f3fbd44, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x457000, dwReserved0=0x46e7bc, dwReserved1=0x190018, cFileName="mscorlib.dll", cAlternateFileName="")) returned 0x99ef60 [0116.857] CoTaskMemFree (pv=0x998a60) [0116.857] FindClose (in: hFindFile=0x99ef60 | out: hFindFile=0x99ef60) returned 1 [0116.857] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x362810 [0116.858] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x363698 [0116.943] wcscpy_s (in: _Destination=0x18fcac, _SizeInWords=0x3b, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll") returned 0x0 [0116.943] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x99ef60 [0116.944] LocalFree (hMem=0x99ef60) returned 0x0 [0116.949] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x1c) returned 0x3638c0 [0116.949] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x2d0000 [0117.011] VirtualAlloc (lpAddress=0x2d0000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x2d0000 [0117.013] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x14) returned 0x3638e8 [0117.019] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x99ef60 [0117.020] LocalFree (hMem=0x99ef60) returned 0x0 [0117.020] wcscpy_s (in: _Destination=0x18fd88, _SizeInWords=0x2f, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned 0x0 [0117.020] wcstok_s (in: _String="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", _Delimiter=";", _Context=0x18faa8*=0x0 | out: _String="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", _Context=0x18faa8*="") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" [0117.020] CoTaskMemAlloc (cb=0x94) returned 0x9a5810 [0117.020] wcscpy_s (in: _Destination=0x9a5810, _SizeInWords=0x4a, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\") returned 0x0 [0117.020] wcscat_s (in: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", _SizeInWords=0x4a, _Source="Microsoft.VisualBasic.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.VisualBasic.dll") returned 0x0 [0117.020] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.VisualBasic.dll", lpFindFileData=0x18fac0 | out: lpFindFileData=0x18fac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97baa43e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97baa43e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x97bf66ff, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x95000, dwReserved0=0x18fb10, dwReserved1=0x1, cFileName="Microsoft.VisualBasic.dll", cAlternateFileName="")) returned 0x99ef60 [0117.021] CoTaskMemFree (pv=0x9a5810) [0117.021] FindClose (in: hFindFile=0x99ef60 | out: hFindFile=0x99ef60) returned 1 [0117.021] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x363908 [0117.021] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x364790 [0117.028] CoTaskMemAlloc (cb=0x90) returned 0x9a7278 [0117.028] wcscpy_s (in: _Destination=0x9a7278, _SizeInWords=0x48, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.VisualBasic.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.VisualBasic.dll") returned 0x0 [0117.029] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x99ef60 [0117.029] LocalFree (hMem=0x99ef60) returned 0x0 [0117.031] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xa4) returned 0x3649b8 [0117.033] CoTaskMemFree (pv=0x9a7278) [0117.033] LoadLibraryExW (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.VisualBasic.dll", hFile=0x0, dwFlags=0x2) returned 0xb20001 [0117.040] GetProcAddress (hModule=0x767f0000, lpProcName="FindResourceW") returned 0x76805971 [0117.040] FindResourceW (hModule=0xb20001, lpName=0x12c, lpType=0xa) returned 0xbaf080 [0117.041] LoadResource (hModule=0xb20001, hResInfo=0xbaf080) returned 0xbaf0a0 [0117.041] SizeofResource (hModule=0xb20001, hResInfo=0xbaf080) returned 0x3ee3 [0117.041] LockResource (hResData=0xbaf0a0) returned 0xbaf0a0 [0117.041] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbaf0a0, cbMultiByte=16099, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16099 [0117.041] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x12c) returned 0x364a68 [0117.041] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x7e00) returned 0x364ba0 [0117.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xbaf0a0, cbMultiByte=16099, lpWideCharStr=0x364ba0, cchWideChar=16099 | out: lpWideCharStr="Option Strict On\r\nOption Explicit On\r\nOption Compare Binary\r\n\r\n'* Copyright (C) Microsoft Corporation. All Rights Reserved.\r\n\r\n#If TARGET = \"module\" AndAlso _MYTYPE = \"\" Then\r\n#Const _MYTYPE=\"Empty\"\r\n#End If\r\n\r\n#If _MYTYPE = \"WindowsForms\" Then\r\n\r\n#Const _MYFORMS = True\r\n#Const _MYWEBSERVICES = True\r\n#Const _MYUSERTYPE = \"Windows\"\r\n#Const _MYCOMPUTERTYPE = \"Windows\"\r\n#Const _MYAPPLICATIONTYPE = \"WindowsForms\"\r\n\r\n#ElseIf _MYTYPE = \"WindowsFormsWithCustomSubMain\" Then\r\n\r\n#Const _MYFORMS = True\r\n#Const _MYWEBSERVICES = True\r\n#Const _MYUSERTYPE = \"Windows\"\r\n#Const _MYCOMPUTERTYPE = \"Windows\"\r\n#Const _MYAPPLICATIONTYPE = \"Console\"\r\n\r\n#ElseIf _MYTYPE = \"Windows\" OrElse _MYTYPE = \"\" Then\r\n\r\n#Const _MYWEBSERVICES = True\r\n#Const _MYUSERTYPE = \"Windows\"\r\n#Const _MYCOMPUTERTYPE = \"Windows\"\r\n#Const _MYAPPLICATIONTYPE = \"Windows\"\r\n\r\n#ElseIf _MYTYPE = \"Console\" Then\r\n\r\n#Const _MYWEBSERVICES = True\r\n#Const _MYUSERTYPE = \"Windows\"\r\n#Const _MYCOMPUTERTYPE = \"Windows\"\r\n#Const _MYAPPLICATIONTYPE = \"Console\"\r\n\r\n#ElseIf _MYTYPE = \"Web\" Then\r\n\r\n#Const _MYFORMS = False\r\n#Const _MYWEBSERVICES = False\r\n#Const _MYUSERTYPE = \"Web\"\r\n#Const _MYCOMPUTERTYPE = \"Web\"\r\n\r\n#ElseIf _MYTYPE = \"WebControl\" Then\r\n\r\n#Const _MYFORMS = False\r\n#Const _MYWEBSERVICES = True\r\n#Const _MYUSERTYPE = \"Web\"\r\n#Const _MYCOMPUTERTYPE = \"Web\"\r\n\r\n#ElseIf _MYTYPE = \"Custom\" Then\r\n\r\n#ElseIf _MYTYPE <> \"Empty\" Then\r\n\r\n#Const _MYTYPE = \"Empty\"\r\n\r\n#End If\r\n\r\n#If _MYTYPE <> \"Empty\" Then\r\n\r\nNamespace My\r\n\r\n#If _MYAPPLICATIONTYPE = \"WindowsForms\" OrElse _MYAPPLICATIONTYPE = \"Windows\" OrElse _MYAPPLICATIONTYPE = \"Console\" Then\r\n\r\n _\r\n Partial Friend Class MyApplication\r\n\r\n#If _MYAPPLICATIONTYPE = \"WindowsForms\" Then\r\n Inherits Global.Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase\r\n#If TARGET = \"winexe\" Then\r\n _\r\n Friend Shared Sub Main(ByVal Args As String())\r\n Try\r\n Global.System.Windows.Forms.Application.SetCompatibleTextRenderingDefault(MyApplication.UseCompatibleTextRendering())\r\n Finally\r\n End Try \r\n My.Application.Run(Args)\r\n End Sub\r\n#End If\r\n\r\n#ElseIf _MYAPPLICATIONTYPE = \"Windows\" Then\r\n Inherits Global.Microsoft.VisualBasic.ApplicationServices.ApplicationBase\r\n#ElseIf _MYAPPLICATIONTYPE = \"Console\" Then\r\n Inherits Global.Microsoft.VisualBasic.ApplicationServices.ConsoleApplicationBase\x09\r\n#End If '_MYAPPLICATIONTYPE = \"WindowsForms\"\r\n\r\n End Class\r\n\r\n#End If '#If _MYAPPLICATIONTYPE = \"WindowsForms\" Or _MYAPPLICATIONTYPE = \"Windows\" or _MYAPPLICATIONTYPE = \"Console\"\r\n\r\n#If _MYCOMPUTERTYPE <> \"\" Then\r\n\r\n _\r\n Partial Friend Class MyComputer\r\n\r\n#If _MYCOMPUTERTYPE = \"Windows\" Then\r\n Inherits Global.Microsoft.VisualBasic.Devices.Computer\r\n#ElseIf _MYCOMPUTERTYPE = \"Web\" Then\r\n Inherits Global.Microsoft.VisualBasic.Devices.ServerComputer\r\n#End If\r\n _\r\n _\r\n Public Sub New()\r\n MyBase.New()\r\n End Sub\r\n End Class\r\n#End If\r\n\r\n _\r\n _\r\n Friend Module MyProject\r\n\r\n#If _MYCOMPUTERTYPE <> \"\" Then\r\n _\r\n Friend ReadOnly Property Computer() As MyComputer\r\n _\r\n Get\r\n Return m_ComputerObjectProvider.GetInstance()\r\n End Get\r\n End Property\r\n\r\n Private ReadOnly m_ComputerObjectProvider As New ThreadSafeObjectProvider(Of MyComputer)\r\n#End If\r\n\r\n#If _MYAPPLICATIONTYPE = \"Windows\" Or _MYAPPLICATIONTYPE = \"WindowsForms\" Or _MYAPPLICATIONTYPE = \"Console\" Then\r\n _\r\n Friend ReadOnly Property Application() As MyApplication\r\n _\r\n Get\r\n Return m_AppObjectProvider.GetInstance()\r\n End Get\r\n End Property\r\n Private ReadOnly m_AppObjectProvider As New ThreadSafeObjectProvider(Of MyApplication)\r\n#End If\r\n\r\n#If _MYUSERTYPE = \"Windows\" Then\r\n _\r\n Friend ReadOnly Property User() As Global.Microsoft.VisualBasic.ApplicationServices.Us") returned 16099 [0117.254] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x8) returned 0x36c9a8 [0117.254] FreeLibrary (hLibModule=0xb20001) returned 1 [0117.255] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x36c9b8 [0117.255] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0117.255] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x36c9c8 [0117.255] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x8) returned 0x36d850 [0117.255] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x36d860 [0117.255] RtlReAllocateHeap (Heap=0x360000, Flags=0x0, Ptr=0x36d850, Size=0x10) returned 0x36d870 [0117.255] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x36d850 [0117.256] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x99ef60 [0117.257] LocalFree (hMem=0x99ef60) returned 0x0 [0117.257] GetProcAddress (hModule=0x767f0000, lpProcName="GetEnvironmentVariableW") returned 0x76801b48 [0117.257] GetEnvironmentVariableW (in: lpName="LIB", lpBuffer=0x0, nSize=0x0 | out: lpBuffer=0x0) returned 0x0 [0117.257] LocalAlloc (uFlags=0x0, uBytes=0x28) returned 0x99ef60 [0117.257] _wcslwr_s (in: _String="r:Accessibility.dll", _SizeInWords=0x14 | out: _String="r:accessibility.dll") returned 0x0 [0117.257] wcstok_s (in: _String="r:accessibility.dll", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="r", _Context=0x18fdd4*="accessibility.dll") returned="r" [0117.257] LocalFree (hMem=0x99ef60) returned 0x0 [0117.257] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x99ef60 [0117.257] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x99ef90 [0117.257] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x998a60 [0117.257] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x9a7290 [0117.258] _wsplitpath_s (in: _FullPath="Accessibility.dll", _Drive=0x99ef90, _DriveCount=0x12, _Dir=0x998a60, _DirCount=0x12, _Filename=0x99ef60, _FilenameCount=0x12, _Ext=0x9a7290, _ExtCount=0x12 | out: _Drive="", _Dir="", _Filename="Accessibility", _Ext=".dll") returned 0x0 [0117.258] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x9a7a78 [0117.258] GetFullPathNameW (in: lpFileName="Accessibility.dll", nBufferLength=0x104, lpBuffer=0x9a7a78, lpFilePart=0x18fb08 | out: lpBuffer="C:\\Windows\\system32\\Accessibility.dll", lpFilePart=0x18fb08*="Accessibility.dll") returned 0x25 [0117.258] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\Accessibility.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x800002, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0x9a7278, ftLastAccessTime.dwLowDateTime=0x9a7278, ftLastAccessTime.dwHighDateTime=0x9a7273, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x980000, nFileSizeLow=0x97f00e8, dwReserved0=0x18fac0, dwReserved1=0x18fbf0, cFileName="\xfc50\x18\x1ecd\x76f3\xa83e\x12\xfffe\xffff\x3ca3\x76ef\x3cce\x76ef\x7f8", cAlternateFileName="\x2d3c\x7680\x9264\x46\x11")) returned 0xffffffff [0117.259] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x9a7c90 [0117.259] LocalAlloc (uFlags=0x0, uBytes=0x82) returned 0x9a7cf8 [0117.259] wcscpy_s (in: _Destination=0x9a7d54, _SizeInWords=0x13, _Source="Accessibility.dll" | out: _Destination="Accessibility.dll") returned 0x0 [0117.259] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Accessibility.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a165e9, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xf6a165e9, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9600d71c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x18fac0, dwReserved1=0x18fbf0, cFileName="Accessibility.dll", cAlternateFileName="")) returned 0x998a90 [0117.259] LocalFree (hMem=0x9a7c90) returned 0x0 [0117.259] FindClose (in: hFindFile=0x998a90 | out: hFindFile=0x998a90) returned 1 [0117.260] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x9a7d88 [0117.260] LocalFree (hMem=0x9a7cf8) returned 0x0 [0117.260] LocalFree (hMem=0x9a7a78) returned 0x0 [0117.260] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0117.260] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x36d888 [0117.260] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x36e710 [0117.268] CoTaskMemAlloc (cb=0x80) returned 0x9a7cf0 [0117.268] wcscpy_s (in: _Destination=0x9a7cf0, _SizeInWords=0x40, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Accessibility.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Accessibility.dll") returned 0x0 [0117.269] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x9acda0 [0117.270] LocalFree (hMem=0x9acda0) returned 0x0 [0117.270] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xa4) returned 0x36e938 [0117.271] CoTaskMemFree (pv=0x9a7cf0) [0117.271] RtlReAllocateHeap (Heap=0x360000, Flags=0x0, Ptr=0x36d870, Size=0x20) returned 0x36e9e8 [0117.271] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x36d870 [0117.271] LocalFree (hMem=0x9a7d88) returned 0x0 [0117.271] LocalFree (hMem=0x998a60) returned 0x0 [0117.271] LocalFree (hMem=0x99ef90) returned 0x0 [0117.271] LocalFree (hMem=0x99ef60) returned 0x0 [0117.271] LocalFree (hMem=0x9a7290) returned 0x0 [0117.271] LocalAlloc (uFlags=0x0, uBytes=0x28) returned 0x9a7290 [0117.271] _wcslwr_s (in: _String="r:Microsoft.Vsa.dll", _SizeInWords=0x14 | out: _String="r:microsoft.vsa.dll") returned 0x0 [0117.271] wcstok_s (in: _String="r:microsoft.vsa.dll", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="r", _Context=0x18fdd4*="microsoft.vsa.dll") returned="r" [0117.271] LocalFree (hMem=0x9a7290) returned 0x0 [0117.271] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x9a7290 [0117.271] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x9a72c0 [0117.271] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x9a72f0 [0117.271] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x9a7320 [0117.271] _wsplitpath_s (in: _FullPath="Microsoft.Vsa.dll", _Drive=0x9a72c0, _DriveCount=0x12, _Dir=0x9a72f0, _DirCount=0x12, _Filename=0x9a7290, _FilenameCount=0x12, _Ext=0x9a7320, _ExtCount=0x12 | out: _Drive="", _Dir="", _Filename="Microsoft.Vsa", _Ext=".dll") returned 0x0 [0117.271] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x9ace80 [0117.271] GetFullPathNameW (in: lpFileName="Microsoft.Vsa.dll", nBufferLength=0x104, lpBuffer=0x9ace80, lpFilePart=0x18fb08 | out: lpBuffer="C:\\Windows\\system32\\Microsoft.Vsa.dll", lpFilePart=0x18fb08*="Microsoft.Vsa.dll") returned 0x25 [0117.271] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\Microsoft.Vsa.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x76ef3472, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x36d870, ftLastAccessTime.dwLowDateTime=0x10, ftLastAccessTime.dwHighDateTime=0x36e9e8, ftLastWriteTime.dwLowDateTime=0x20, ftLastWriteTime.dwHighDateTime=0x36d868, nFileSizeHigh=0x18fc88, nFileSizeLow=0x76f02bd2, dwReserved0=0x360000, dwReserved1=0x7, cFileName="ℵ盰鳖盤", cAlternateFileName="\x2d3c\x7680\x9264\x46\x11")) returned 0xffffffff [0117.271] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x9acda0 [0117.271] LocalAlloc (uFlags=0x0, uBytes=0x82) returned 0x9a7cf0 [0117.271] wcscpy_s (in: _Destination=0x9a7d4c, _SizeInWords=0x13, _Source="Microsoft.Vsa.dll" | out: _Destination="Microsoft.Vsa.dll") returned 0x0 [0117.271] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Vsa.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb915df6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xfb915df6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0xa40d94bc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x360000, dwReserved1=0x7, cFileName="Microsoft.Vsa.dll", cAlternateFileName="")) returned 0x99ef60 [0117.272] LocalFree (hMem=0x9acda0) returned 0x0 [0117.272] FindClose (in: hFindFile=0x99ef60 | out: hFindFile=0x99ef60) returned 1 [0117.272] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x998a60 [0117.272] LocalFree (hMem=0x9a7cf0) returned 0x0 [0117.272] LocalFree (hMem=0x9ace80) returned 0x0 [0117.272] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0117.272] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x36ea10 [0117.272] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x36f898 [0117.276] CoTaskMemAlloc (cb=0x80) returned 0x9a7cf0 [0117.277] wcscpy_s (in: _Destination=0x9a7cf0, _SizeInWords=0x40, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Vsa.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Microsoft.Vsa.dll") returned 0x0 [0117.277] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x9acda0 [0117.278] LocalFree (hMem=0x9acda0) returned 0x0 [0117.278] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xa4) returned 0x36fac0 [0117.279] CoTaskMemFree (pv=0x9a7cf0) [0117.279] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x36fb70 [0117.279] LocalFree (hMem=0x998a60) returned 0x0 [0117.279] LocalFree (hMem=0x9a72f0) returned 0x0 [0117.279] LocalFree (hMem=0x9a72c0) returned 0x0 [0117.279] LocalFree (hMem=0x9a7290) returned 0x0 [0117.279] LocalFree (hMem=0x9a7320) returned 0x0 [0117.279] LocalAlloc (uFlags=0x0, uBytes=0x36) returned 0x9acda0 [0117.279] _wcslwr_s (in: _String="r:System.Configuration.dll", _SizeInWords=0x1b | out: _String="r:system.configuration.dll") returned 0x0 [0117.279] wcstok_s (in: _String="r:system.configuration.dll", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="r", _Context=0x18fdd4*="system.configuration.dll") returned="r" [0117.279] LocalFree (hMem=0x9acda0) returned 0x0 [0117.279] LocalAlloc (uFlags=0x0, uBytes=0x32) returned 0x9acda0 [0117.279] LocalAlloc (uFlags=0x0, uBytes=0x32) returned 0x99ef60 [0117.279] LocalAlloc (uFlags=0x0, uBytes=0x32) returned 0x99efa0 [0117.279] LocalAlloc (uFlags=0x0, uBytes=0x32) returned 0x9b6908 [0117.279] _wsplitpath_s (in: _FullPath="System.Configuration.dll", _Drive=0x99ef60, _DriveCount=0x19, _Dir=0x99efa0, _DirCount=0x19, _Filename=0x9acda0, _FilenameCount=0x19, _Ext=0x9b6908, _ExtCount=0x19 | out: _Drive="", _Dir="", _Filename="System.Configuration", _Ext=".dll") returned 0x0 [0117.279] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x9b78f0 [0117.279] GetFullPathNameW (in: lpFileName="System.Configuration.dll", nBufferLength=0x104, lpBuffer=0x9b78f0, lpFilePart=0x18fb08 | out: lpBuffer="C:\\Windows\\system32\\System.Configuration.dll", lpFilePart=0x18fb08*="System.Configuration.dll") returned 0x2c [0117.279] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\System.Configuration.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x800002, ftCreationTime.dwLowDateTime=0x8, ftCreationTime.dwHighDateTime=0x9b68f0, ftLastAccessTime.dwLowDateTime=0x9b68f0, ftLastAccessTime.dwHighDateTime=0x9b68eb, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x2, nFileSizeHigh=0x980000, nFileSizeLow=0x9360000, dwReserved0=0x18fac0, dwReserved1=0x0, cFileName="\xfc50\x18\x1ecd\x76f3\xa83e\x12\xfffe\xffff\x3ca3\x76ef\x3cce\x76ef\xff8", cAlternateFileName="\x2d3c\x7680\x9264\x46\x18")) returned 0xffffffff [0117.280] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x998a60 [0117.280] LocalAlloc (uFlags=0x0, uBytes=0x90) returned 0x9a7cf0 [0117.280] wcscpy_s (in: _Destination=0x9a7d4c, _SizeInWords=0x1a, _Source="System.Configuration.dll" | out: _Destination="System.Configuration.dll") returned 0x0 [0117.280] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Configuration.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3bd2e0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d3bd2e0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d3bd2e0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x68000, dwReserved0=0x18fac0, dwReserved1=0x0, cFileName="System.configuration.dll", cAlternateFileName="")) returned 0x9b6948 [0117.281] LocalFree (hMem=0x998a60) returned 0x0 [0117.281] FindClose (in: hFindFile=0x9b6948 | out: hFindFile=0x9b6948) returned 1 [0117.281] LocalAlloc (uFlags=0x0, uBytes=0x8e) returned 0x9b7b08 [0117.281] LocalFree (hMem=0x9a7cf0) returned 0x0 [0117.281] LocalFree (hMem=0x9b78f0) returned 0x0 [0117.281] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0117.281] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x36fb80 [0117.281] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x370a08 [0117.286] CoTaskMemAlloc (cb=0x8e) returned 0x9b7a38 [0117.286] wcscpy_s (in: _Destination=0x9b7a38, _SizeInWords=0x47, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Configuration.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Configuration.dll") returned 0x0 [0117.287] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x998a60 [0117.287] LocalFree (hMem=0x998a60) returned 0x0 [0117.290] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xa4) returned 0x370c30 [0117.292] CoTaskMemFree (pv=0x9b7a38) [0117.292] RtlReAllocateHeap (Heap=0x360000, Flags=0x0, Ptr=0x36e9e8, Size=0x40) returned 0x370ce0 [0117.292] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x36e9e8 [0117.292] LocalFree (hMem=0x9b7b08) returned 0x0 [0117.292] LocalFree (hMem=0x99efa0) returned 0x0 [0117.292] LocalFree (hMem=0x99ef60) returned 0x0 [0117.292] LocalFree (hMem=0x9acda0) returned 0x0 [0117.292] LocalFree (hMem=0x9b6908) returned 0x0 [0117.292] LocalAlloc (uFlags=0x0, uBytes=0x46) returned 0x99af70 [0117.292] _wcslwr_s (in: _String="r:System.Configuration.Install.dll", _SizeInWords=0x23 | out: _String="r:system.configuration.install.dll") returned 0x0 [0117.292] wcstok_s (in: _String="r:system.configuration.install.dll", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="r", _Context=0x18fdd4*="system.configuration.install.dll") returned="r" [0117.293] LocalFree (hMem=0x99af70) returned 0x0 [0117.293] LocalAlloc (uFlags=0x0, uBytes=0x42) returned 0x99af70 [0117.293] LocalAlloc (uFlags=0x0, uBytes=0x42) returned 0x99b0b0 [0117.293] LocalAlloc (uFlags=0x0, uBytes=0x42) returned 0x99b100 [0117.293] LocalAlloc (uFlags=0x0, uBytes=0x42) returned 0x99b150 [0117.293] _wsplitpath_s (in: _FullPath="System.Configuration.Install.dll", _Drive=0x99b0b0, _DriveCount=0x21, _Dir=0x99b100, _DirCount=0x21, _Filename=0x99af70, _FilenameCount=0x21, _Ext=0x99b150, _ExtCount=0x21 | out: _Drive="", _Dir="", _Filename="System.Configuration.Install", _Ext=".dll") returned 0x0 [0117.293] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x9b94c0 [0117.293] GetFullPathNameW (in: lpFileName="System.Configuration.Install.dll", nBufferLength=0x104, lpBuffer=0x9b94c0, lpFilePart=0x18fb08 | out: lpBuffer="C:\\Windows\\system32\\System.Configuration.Install.dll", lpFilePart=0x18fb08*="System.Configuration.Install.dll") returned 0x34 [0117.293] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\System.Configuration.Install.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x76ef3472, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x36e9e8, ftLastAccessTime.dwLowDateTime=0x20, ftLastAccessTime.dwHighDateTime=0x370ce0, ftLastWriteTime.dwLowDateTime=0x40, ftLastWriteTime.dwHighDateTime=0x2, nFileSizeHigh=0x36e9e0, nFileSizeLow=0x360000, dwReserved0=0x36ea08, dwReserved1=0x7, cFileName="ℵ盰鳖盤", cAlternateFileName="\x2d3c\x7680\x9264\x46\x20")) returned 0xffffffff [0117.293] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x9acda0 [0117.293] LocalAlloc (uFlags=0x0, uBytes=0xa0) returned 0x9a7cf0 [0117.293] wcscpy_s (in: _Destination=0x9a7d4c, _SizeInWords=0x22, _Source="System.Configuration.Install.dll" | out: _Destination="System.Configuration.Install.dll") returned 0x0 [0117.293] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Configuration.Install.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8764527d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8764527d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8779bedf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x36ea08, dwReserved1=0x7, cFileName="System.Configuration.Install.dll", cAlternateFileName="")) returned 0x9b6908 [0117.293] LocalFree (hMem=0x9acda0) returned 0x0 [0117.293] FindClose (in: hFindFile=0x9b6908 | out: hFindFile=0x9b6908) returned 1 [0117.293] LocalAlloc (uFlags=0x0, uBytes=0x9e) returned 0x9b7a38 [0117.294] LocalFree (hMem=0x9a7cf0) returned 0x0 [0117.294] LocalFree (hMem=0x9b94c0) returned 0x0 [0117.294] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0117.294] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x370d28 [0117.301] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x371bb0 [0117.305] CoTaskMemAlloc (cb=0x9e) returned 0x9b7ae0 [0117.305] wcscpy_s (in: _Destination=0x9b7ae0, _SizeInWords=0x4f, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Configuration.Install.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Configuration.Install.dll") returned 0x0 [0117.306] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x9acda0 [0117.306] LocalFree (hMem=0x9acda0) returned 0x0 [0117.308] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xa4) returned 0x371dd8 [0117.308] CoTaskMemFree (pv=0x9b7ae0) [0117.308] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x36e9f8 [0117.308] LocalFree (hMem=0x9b7a38) returned 0x0 [0117.309] LocalFree (hMem=0x99b100) returned 0x0 [0117.309] LocalFree (hMem=0x99b0b0) returned 0x0 [0117.309] LocalFree (hMem=0x99af70) returned 0x0 [0117.309] LocalFree (hMem=0x99b150) returned 0x0 [0117.309] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x9a7320 [0117.309] _wcslwr_s (in: _String="r:System.Data.dll", _SizeInWords=0x12 | out: _String="r:system.data.dll") returned 0x0 [0117.309] wcstok_s (in: _String="r:system.data.dll", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="r", _Context=0x18fdd4*="system.data.dll") returned="r" [0117.309] LocalFree (hMem=0x9a7320) returned 0x0 [0117.309] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x99f3e0 [0117.309] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x99f408 [0117.309] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x99f430 [0117.309] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x99f458 [0117.309] _wsplitpath_s (in: _FullPath="System.Data.dll", _Drive=0x99f408, _DriveCount=0x10, _Dir=0x99f430, _DirCount=0x10, _Filename=0x99f3e0, _FilenameCount=0x10, _Ext=0x99f458, _ExtCount=0x10 | out: _Drive="", _Dir="", _Filename="System.Data", _Ext=".dll") returned 0x0 [0117.309] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x9baf28 [0117.309] GetFullPathNameW (in: lpFileName="System.Data.dll", nBufferLength=0x104, lpBuffer=0x9baf28, lpFilePart=0x18fb08 | out: lpBuffer="C:\\Windows\\system32\\System.Data.dll", lpFilePart=0x18fb08*="System.Data.dll") returned 0x23 [0117.309] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\System.Data.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x400, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x18fb70, ftLastAccessTime.dwLowDateTime=0x71d12fc9, ftLastAccessTime.dwHighDateTime=0xd, ftLastWriteTime.dwLowDateTime=0x1, ftLastWriteTime.dwHighDateTime=0x400, nFileSizeHigh=0x18fb80, nFileSizeLow=0x2, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x2d3c\x7680\x9264\x46\x0f")) returned 0xffffffff [0117.309] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x9acda0 [0117.309] LocalAlloc (uFlags=0x0, uBytes=0x7e) returned 0x998a60 [0117.309] wcscpy_s (in: _Destination=0x998abc, _SizeInWords=0x11, _Source="System.Data.dll" | out: _Destination="System.Data.dll") returned 0x0 [0117.309] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Data.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ec3f5b6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ec3f5b6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ec8b877, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2cac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.dll", cAlternateFileName="")) returned 0x9b6908 [0117.309] LocalFree (hMem=0x9acda0) returned 0x0 [0117.309] FindClose (in: hFindFile=0x9b6908 | out: hFindFile=0x9b6908) returned 1 [0117.310] LocalAlloc (uFlags=0x0, uBytes=0x7c) returned 0x9a7cf0 [0117.310] LocalFree (hMem=0x998a60) returned 0x0 [0117.310] LocalFree (hMem=0x9baf28) returned 0x0 [0117.310] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0117.310] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x371e88 [0117.311] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x372d10 [0117.317] CoTaskMemAlloc (cb=0x7c) returned 0x998a60 [0117.317] wcscpy_s (in: _Destination=0x998a60, _SizeInWords=0x3e, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Data.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Data.dll") returned 0x0 [0117.317] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x9acda0 [0117.318] LocalFree (hMem=0x9acda0) returned 0x0 [0117.321] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x14) returned 0x372f38 [0117.324] CoTaskMemFree (pv=0x998a60) [0117.325] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x372f58 [0117.325] LocalFree (hMem=0x9a7cf0) returned 0x0 [0117.325] LocalFree (hMem=0x99f430) returned 0x0 [0117.325] LocalFree (hMem=0x99f408) returned 0x0 [0117.325] LocalFree (hMem=0x99f3e0) returned 0x0 [0117.325] LocalFree (hMem=0x99f458) returned 0x0 [0117.325] LocalAlloc (uFlags=0x0, uBytes=0x3e) returned 0x994e38 [0117.325] _wcslwr_s (in: _String="r:System.Data.OracleClient.dll", _SizeInWords=0x1f | out: _String="r:system.data.oracleclient.dll") returned 0x0 [0117.325] wcstok_s (in: _String="r:system.data.oracleclient.dll", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="r", _Context=0x18fdd4*="system.data.oracleclient.dll") returned="r" [0117.325] LocalFree (hMem=0x994e38) returned 0x0 [0117.325] LocalAlloc (uFlags=0x0, uBytes=0x3a) returned 0x994e38 [0117.325] LocalAlloc (uFlags=0x0, uBytes=0x3a) returned 0x994e80 [0117.325] LocalAlloc (uFlags=0x0, uBytes=0x3a) returned 0x994ec8 [0117.325] LocalAlloc (uFlags=0x0, uBytes=0x3a) returned 0x994f10 [0117.325] _wsplitpath_s (in: _FullPath="System.Data.OracleClient.dll", _Drive=0x994e80, _DriveCount=0x1d, _Dir=0x994ec8, _DirCount=0x1d, _Filename=0x994e38, _FilenameCount=0x1d, _Ext=0x994f10, _ExtCount=0x1d | out: _Drive="", _Dir="", _Filename="System.Data.OracleClient", _Ext=".dll") returned 0x0 [0117.325] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x9bc848 [0117.325] GetFullPathNameW (in: lpFileName="System.Data.OracleClient.dll", nBufferLength=0x104, lpBuffer=0x9bc848, lpFilePart=0x18fb08 | out: lpBuffer="C:\\Windows\\system32\\System.Data.OracleClient.dll", lpFilePart=0x18fb08*="System.Data.OracleClient.dll") returned 0x30 [0117.325] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\System.Data.OracleClient.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x400, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x18fb70, ftLastAccessTime.dwLowDateTime=0x71d12fc9, ftLastAccessTime.dwHighDateTime=0xd, ftLastWriteTime.dwLowDateTime=0x1, ftLastWriteTime.dwHighDateTime=0x2, nFileSizeHigh=0x372f50, nFileSizeLow=0x360000, dwReserved0=0x372fe0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x2d3c\x7680\x9264\x46\x1c")) returned 0xffffffff [0117.325] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x9acda0 [0117.325] LocalAlloc (uFlags=0x0, uBytes=0x98) returned 0x9a7cf0 [0117.325] wcscpy_s (in: _Destination=0x9a7d4c, _SizeInWords=0x1e, _Source="System.Data.OracleClient.dll" | out: _Destination="System.Data.OracleClient.dll") returned 0x0 [0117.325] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Data.OracleClient.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92ddb48f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92ddb48f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92ddb48f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76c00, dwReserved0=0x372fe0, dwReserved1=0x0, cFileName="System.Data.OracleClient.dll", cAlternateFileName="")) returned 0x9b6908 [0117.326] LocalFree (hMem=0x9acda0) returned 0x0 [0117.326] FindClose (in: hFindFile=0x9b6908 | out: hFindFile=0x9b6908) returned 1 [0117.326] LocalAlloc (uFlags=0x0, uBytes=0x96) returned 0x9bca60 [0117.326] LocalFree (hMem=0x9a7cf0) returned 0x0 [0117.326] LocalFree (hMem=0x9bc848) returned 0x0 [0117.326] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0117.326] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x372f68 [0117.644] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x373df0 [0117.650] CoTaskMemAlloc (cb=0x96) returned 0x9bc990 [0117.650] wcscpy_s (in: _Destination=0x9bc990, _SizeInWords=0x4b, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Data.OracleClient.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Data.OracleClient.dll") returned 0x0 [0117.651] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x9acda0 [0117.652] LocalFree (hMem=0x9acda0) returned 0x0 [0117.655] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x14) returned 0x374018 [0117.657] CoTaskMemFree (pv=0x9bc990) [0117.657] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x374038 [0117.657] LocalFree (hMem=0x9bca60) returned 0x0 [0117.657] LocalFree (hMem=0x994ec8) returned 0x0 [0117.657] LocalFree (hMem=0x994e80) returned 0x0 [0117.657] LocalFree (hMem=0x994e38) returned 0x0 [0117.657] LocalFree (hMem=0x994f10) returned 0x0 [0117.657] LocalAlloc (uFlags=0x0, uBytes=0x32) returned 0x9b6908 [0117.657] _wcslwr_s (in: _String="r:System.Data.SqlXml.dll", _SizeInWords=0x19 | out: _String="r:system.data.sqlxml.dll") returned 0x0 [0117.657] wcstok_s (in: _String="r:system.data.sqlxml.dll", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="r", _Context=0x18fdd4*="system.data.sqlxml.dll") returned="r" [0117.657] LocalFree (hMem=0x9b6908) returned 0x0 [0117.657] LocalAlloc (uFlags=0x0, uBytes=0x2e) returned 0x99ded0 [0117.657] LocalAlloc (uFlags=0x0, uBytes=0x2e) returned 0x99df08 [0117.657] LocalAlloc (uFlags=0x0, uBytes=0x2e) returned 0x99df40 [0117.657] LocalAlloc (uFlags=0x0, uBytes=0x2e) returned 0x99df78 [0117.657] _wsplitpath_s (in: _FullPath="System.Data.SqlXml.dll", _Drive=0x99df08, _DriveCount=0x17, _Dir=0x99df40, _DirCount=0x17, _Filename=0x99ded0, _FilenameCount=0x17, _Ext=0x99df78, _ExtCount=0x17 | out: _Drive="", _Dir="", _Filename="System.Data.SqlXml", _Ext=".dll") returned 0x0 [0117.657] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x9bfc20 [0117.657] GetFullPathNameW (in: lpFileName="System.Data.SqlXml.dll", nBufferLength=0x104, lpBuffer=0x9bfc20, lpFilePart=0x18fb08 | out: lpBuffer="C:\\Windows\\system32\\System.Data.SqlXml.dll", lpFilePart=0x18fb08*="System.Data.SqlXml.dll") returned 0x2a [0117.657] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\System.Data.SqlXml.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x400, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x18fb70, ftLastAccessTime.dwLowDateTime=0x71d12fc9, ftLastAccessTime.dwHighDateTime=0xd, ftLastWriteTime.dwLowDateTime=0x1, ftLastWriteTime.dwHighDateTime=0x2, nFileSizeHigh=0x374030, nFileSizeLow=0x360000, dwReserved0=0x374fe0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x2d3c\x7680\x9264\x46\x16")) returned 0xffffffff [0117.711] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x9acda0 [0117.711] LocalAlloc (uFlags=0x0, uBytes=0x8c) returned 0x9a7cf0 [0117.711] wcscpy_s (in: _Destination=0x9a7d4c, _SizeInWords=0x18, _Source="System.Data.SqlXml.dll" | out: _Destination="System.Data.SqlXml.dll") returned 0x0 [0117.711] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Data.SqlXml.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bbbf51d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bbbf51d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bbe567d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb6000, dwReserved0=0x374fe0, dwReserved1=0x0, cFileName="System.Data.SqlXml.dll", cAlternateFileName="")) returned 0x9b6908 [0117.711] LocalFree (hMem=0x9acda0) returned 0x0 [0117.711] FindClose (in: hFindFile=0x9b6908 | out: hFindFile=0x9b6908) returned 1 [0117.711] LocalAlloc (uFlags=0x0, uBytes=0x8a) returned 0x9bc990 [0117.711] LocalFree (hMem=0x9a7cf0) returned 0x0 [0117.711] LocalFree (hMem=0x9bfc20) returned 0x0 [0117.711] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0117.711] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x374048 [0117.711] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x374ed0 [0117.719] CoTaskMemAlloc (cb=0x8a) returned 0x9bca28 [0117.719] wcscpy_s (in: _Destination=0x9bca28, _SizeInWords=0x45, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Data.SqlXml.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Data.SqlXml.dll") returned 0x0 [0117.720] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x9acda0 [0117.720] LocalFree (hMem=0x9acda0) returned 0x0 [0117.724] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x14) returned 0x3750f8 [0117.725] CoTaskMemFree (pv=0x9bca28) [0117.725] RtlReAllocateHeap (Heap=0x360000, Flags=0x0, Ptr=0x370ce0, Size=0x80) returned 0x375118 [0117.725] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x370ce0 [0117.725] LocalFree (hMem=0x9bc990) returned 0x0 [0117.726] LocalFree (hMem=0x99df40) returned 0x0 [0117.726] LocalFree (hMem=0x99df08) returned 0x0 [0117.726] LocalFree (hMem=0x99ded0) returned 0x0 [0117.726] LocalFree (hMem=0x99df78) returned 0x0 [0117.726] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x99df78 [0117.726] _wcslwr_s (in: _String="r:System.Deployment.dll", _SizeInWords=0x18 | out: _String="r:system.deployment.dll") returned 0x0 [0117.726] wcstok_s (in: _String="r:system.deployment.dll", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="r", _Context=0x18fdd4*="system.deployment.dll") returned="r" [0117.726] LocalFree (hMem=0x99df78) returned 0x0 [0117.726] LocalAlloc (uFlags=0x0, uBytes=0x2c) returned 0x99df78 [0117.726] LocalAlloc (uFlags=0x0, uBytes=0x2c) returned 0x99ded0 [0117.726] LocalAlloc (uFlags=0x0, uBytes=0x2c) returned 0x99df08 [0117.726] LocalAlloc (uFlags=0x0, uBytes=0x2c) returned 0x99df40 [0117.726] _wsplitpath_s (in: _FullPath="System.Deployment.dll", _Drive=0x99ded0, _DriveCount=0x16, _Dir=0x99df08, _DirCount=0x16, _Filename=0x99df78, _FilenameCount=0x16, _Ext=0x99df40, _ExtCount=0x16 | out: _Drive="", _Dir="", _Filename="System.Deployment", _Ext=".dll") returned 0x0 [0117.726] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x9c1688 [0117.726] GetFullPathNameW (in: lpFileName="System.Deployment.dll", nBufferLength=0x104, lpBuffer=0x9c1688, lpFilePart=0x18fb08 | out: lpBuffer="C:\\Windows\\system32\\System.Deployment.dll", lpFilePart=0x18fb08*="System.Deployment.dll") returned 0x29 [0117.726] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\System.Deployment.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x76ef3472, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x370ce0, ftLastAccessTime.dwLowDateTime=0x40, ftLastAccessTime.dwHighDateTime=0x375118, ftLastWriteTime.dwLowDateTime=0x80, ftLastWriteTime.dwHighDateTime=0x2, nFileSizeHigh=0x370cd8, nFileSizeLow=0x360000, dwReserved0=0x370d20, dwReserved1=0x7, cFileName="ℵ盰鳖盤", cAlternateFileName="\x2d3c\x7680\x9264\x46\x15")) returned 0xffffffff [0117.726] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x9acda0 [0117.726] LocalAlloc (uFlags=0x0, uBytes=0x8a) returned 0x9a7cf0 [0117.726] wcscpy_s (in: _Destination=0x9a7d4c, _SizeInWords=0x17, _Source="System.Deployment.dll" | out: _Destination="System.Deployment.dll") returned 0x0 [0117.726] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Deployment.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d135b7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d135b7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d15bcdc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xed000, dwReserved0=0x370d20, dwReserved1=0x7, cFileName="System.Deployment.dll", cAlternateFileName="")) returned 0x9b6908 [0117.726] LocalFree (hMem=0x9acda0) returned 0x0 [0117.726] FindClose (in: hFindFile=0x9b6908 | out: hFindFile=0x9b6908) returned 1 [0117.727] LocalAlloc (uFlags=0x0, uBytes=0x88) returned 0x9bc990 [0117.727] LocalFree (hMem=0x9a7cf0) returned 0x0 [0117.727] LocalFree (hMem=0x9c1688) returned 0x0 [0117.727] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0117.727] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x3751a0 [0117.733] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x376028 [0117.739] CoTaskMemAlloc (cb=0x88) returned 0x9bca20 [0117.739] wcscpy_s (in: _Destination=0x9bca20, _SizeInWords=0x44, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Deployment.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Deployment.dll") returned 0x0 [0117.740] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x9acda0 [0117.740] LocalFree (hMem=0x9acda0) returned 0x0 [0117.744] VirtualAlloc (lpAddress=0x2ba000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x2ba000 [0117.749] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xa4) returned 0x376250 [0117.754] CoTaskMemFree (pv=0x9bca20) [0117.754] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x370cf0 [0117.754] LocalFree (hMem=0x9bc990) returned 0x0 [0117.754] LocalFree (hMem=0x99df08) returned 0x0 [0117.754] LocalFree (hMem=0x99ded0) returned 0x0 [0117.754] LocalFree (hMem=0x99df78) returned 0x0 [0117.754] LocalFree (hMem=0x99df40) returned 0x0 [0117.754] LocalAlloc (uFlags=0x0, uBytes=0x28) returned 0x9a7320 [0117.754] _wcslwr_s (in: _String="r:System.Design.dll", _SizeInWords=0x14 | out: _String="r:system.design.dll") returned 0x0 [0117.754] wcstok_s (in: _String="r:system.design.dll", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="r", _Context=0x18fdd4*="system.design.dll") returned="r" [0117.754] LocalFree (hMem=0x9a7320) returned 0x0 [0117.754] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x9a7320 [0117.754] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x9a7290 [0117.754] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x9a72c0 [0117.754] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x9a72f0 [0117.754] _wsplitpath_s (in: _FullPath="System.Design.dll", _Drive=0x9a7290, _DriveCount=0x12, _Dir=0x9a72c0, _DirCount=0x12, _Filename=0x9a7320, _FilenameCount=0x12, _Ext=0x9a72f0, _ExtCount=0x12 | out: _Drive="", _Dir="", _Filename="System.Design", _Ext=".dll") returned 0x0 [0117.754] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x9c30f0 [0117.754] GetFullPathNameW (in: lpFileName="System.Design.dll", nBufferLength=0x104, lpBuffer=0x9c30f0, lpFilePart=0x18fb08 | out: lpBuffer="C:\\Windows\\system32\\System.Design.dll", lpFilePart=0x18fb08*="System.Design.dll") returned 0x25 [0117.754] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\System.Design.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x400, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x18fb70, ftLastAccessTime.dwLowDateTime=0x71d12fc9, ftLastAccessTime.dwHighDateTime=0xd, ftLastWriteTime.dwLowDateTime=0x1, ftLastWriteTime.dwHighDateTime=0x2, nFileSizeHigh=0x370ce8, nFileSizeLow=0x360000, dwReserved0=0x370d20, dwReserved1=0x0, cFileName="", cAlternateFileName="\x2d3c\x7680\x9264\x46\x11")) returned 0xffffffff [0117.755] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x9acda0 [0117.755] LocalAlloc (uFlags=0x0, uBytes=0x82) returned 0x9a7cf0 [0117.755] wcscpy_s (in: _Destination=0x9a7d4c, _SizeInWords=0x13, _Source="System.Design.dll" | out: _Destination="System.Design.dll") returned 0x0 [0117.755] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Design.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97f3c545, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97f3c545, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x982f47ac, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4b3000, dwReserved0=0x370d20, dwReserved1=0x0, cFileName="System.Design.dll", cAlternateFileName="")) returned 0x9b6908 [0117.755] LocalFree (hMem=0x9acda0) returned 0x0 [0117.755] FindClose (in: hFindFile=0x9b6908 | out: hFindFile=0x9b6908) returned 1 [0117.756] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x998a60 [0117.756] LocalFree (hMem=0x9a7cf0) returned 0x0 [0117.756] LocalFree (hMem=0x9c30f0) returned 0x0 [0117.756] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0117.756] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x376300 [0117.756] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x377188 [0117.769] CoTaskMemAlloc (cb=0x80) returned 0x9a7cf0 [0117.769] wcscpy_s (in: _Destination=0x9a7cf0, _SizeInWords=0x40, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Design.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Design.dll") returned 0x0 [0117.769] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x9acda0 [0117.770] LocalFree (hMem=0x9acda0) returned 0x0 [0117.772] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xa4) returned 0x3773b0 [0117.779] CoTaskMemFree (pv=0x9a7cf0) [0117.779] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x370d00 [0117.779] LocalFree (hMem=0x998a60) returned 0x0 [0117.779] LocalFree (hMem=0x9a72c0) returned 0x0 [0117.779] LocalFree (hMem=0x9a7290) returned 0x0 [0117.779] LocalFree (hMem=0x9a7320) returned 0x0 [0117.779] LocalFree (hMem=0x9a72f0) returned 0x0 [0117.779] LocalAlloc (uFlags=0x0, uBytes=0x3e) returned 0x994f10 [0117.779] _wcslwr_s (in: _String="r:System.DirectoryServices.dll", _SizeInWords=0x1f | out: _String="r:system.directoryservices.dll") returned 0x0 [0117.779] wcstok_s (in: _String="r:system.directoryservices.dll", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="r", _Context=0x18fdd4*="system.directoryservices.dll") returned="r" [0117.779] LocalFree (hMem=0x994f10) returned 0x0 [0117.779] LocalAlloc (uFlags=0x0, uBytes=0x3a) returned 0x994f10 [0117.779] LocalAlloc (uFlags=0x0, uBytes=0x3a) returned 0x994e38 [0117.779] LocalAlloc (uFlags=0x0, uBytes=0x3a) returned 0x994e80 [0117.779] LocalAlloc (uFlags=0x0, uBytes=0x3a) returned 0x994ec8 [0117.779] _wsplitpath_s (in: _FullPath="System.DirectoryServices.dll", _Drive=0x994e38, _DriveCount=0x1d, _Dir=0x994e80, _DirCount=0x1d, _Filename=0x994f10, _FilenameCount=0x1d, _Ext=0x994ec8, _ExtCount=0x1d | out: _Drive="", _Dir="", _Filename="System.DirectoryServices", _Ext=".dll") returned 0x0 [0117.779] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x9c4a10 [0117.779] GetFullPathNameW (in: lpFileName="System.DirectoryServices.dll", nBufferLength=0x104, lpBuffer=0x9c4a10, lpFilePart=0x18fb08 | out: lpBuffer="C:\\Windows\\system32\\System.DirectoryServices.dll", lpFilePart=0x18fb08*="System.DirectoryServices.dll") returned 0x30 [0117.780] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\System.DirectoryServices.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x400, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x18fb70, ftLastAccessTime.dwLowDateTime=0x71d12fc9, ftLastAccessTime.dwHighDateTime=0xd, ftLastWriteTime.dwLowDateTime=0x1, ftLastWriteTime.dwHighDateTime=0x2, nFileSizeHigh=0x370cf8, nFileSizeLow=0x360000, dwReserved0=0x370d20, dwReserved1=0x0, cFileName="", cAlternateFileName="\x2d3c\x7680\x9264\x46\x1c")) returned 0xffffffff [0117.780] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x9acda0 [0117.780] LocalAlloc (uFlags=0x0, uBytes=0x98) returned 0x9a7cf0 [0117.780] wcscpy_s (in: _Destination=0x9a7d4c, _SizeInWords=0x1e, _Source="System.DirectoryServices.dll" | out: _Destination="System.DirectoryServices.dll") returned 0x0 [0117.780] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.DirectoryServices.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1ce0fd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d1ce0fd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d1f425d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x62000, dwReserved0=0x370d20, dwReserved1=0x0, cFileName="System.DirectoryServices.dll", cAlternateFileName="")) returned 0x9b6908 [0117.780] LocalFree (hMem=0x9acda0) returned 0x0 [0117.780] FindClose (in: hFindFile=0x9b6908 | out: hFindFile=0x9b6908) returned 1 [0117.780] LocalAlloc (uFlags=0x0, uBytes=0x96) returned 0x9c4c28 [0117.780] LocalFree (hMem=0x9a7cf0) returned 0x0 [0117.780] LocalFree (hMem=0x9c4a10) returned 0x0 [0117.780] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0117.780] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x377460 [0117.786] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x3782e8 [0117.797] CoTaskMemAlloc (cb=0x96) returned 0x9c4b58 [0117.797] wcscpy_s (in: _Destination=0x9c4b58, _SizeInWords=0x4b, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.DirectoryServices.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.DirectoryServices.dll") returned 0x0 [0117.798] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x9acda0 [0117.798] LocalFree (hMem=0x9acda0) returned 0x0 [0117.805] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xa4) returned 0x378510 [0117.807] CoTaskMemFree (pv=0x9c4b58) [0117.807] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x370d10 [0117.807] LocalFree (hMem=0x9c4c28) returned 0x0 [0117.807] LocalFree (hMem=0x994e80) returned 0x0 [0117.808] LocalFree (hMem=0x994e38) returned 0x0 [0117.808] LocalFree (hMem=0x994f10) returned 0x0 [0117.808] LocalFree (hMem=0x994ec8) returned 0x0 [0117.808] LocalAlloc (uFlags=0x0, uBytes=0x1a) returned 0x99f458 [0117.808] _wcslwr_s (in: _String="r:System.dll", _SizeInWords=0xd | out: _String="r:system.dll") returned 0x0 [0117.808] wcstok_s (in: _String="r:system.dll", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="r", _Context=0x18fdd4*="system.dll") returned="r" [0117.808] LocalFree (hMem=0x99f458) returned 0x0 [0117.808] LocalAlloc (uFlags=0x0, uBytes=0x16) returned 0x9c6660 [0117.808] LocalAlloc (uFlags=0x0, uBytes=0x16) returned 0x9c6680 [0117.808] LocalAlloc (uFlags=0x0, uBytes=0x16) returned 0x9c66a0 [0117.808] LocalAlloc (uFlags=0x0, uBytes=0x16) returned 0x9c66c0 [0117.808] _wsplitpath_s (in: _FullPath="System.dll", _Drive=0x9c6680, _DriveCount=0xb, _Dir=0x9c66a0, _DirCount=0xb, _Filename=0x9c6660, _FilenameCount=0xb, _Ext=0x9c66c0, _ExtCount=0xb | out: _Drive="", _Dir="", _Filename="System", _Ext=".dll") returned 0x0 [0117.808] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x9c6de8 [0117.808] GetFullPathNameW (in: lpFileName="System.dll", nBufferLength=0x104, lpBuffer=0x9c6de8, lpFilePart=0x18fb08 | out: lpBuffer="C:\\Windows\\system32\\System.dll", lpFilePart=0x18fb08*="System.dll") returned 0x1e [0117.808] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\System.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x400, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x18fb70, ftLastAccessTime.dwLowDateTime=0x71d12fc9, ftLastAccessTime.dwHighDateTime=0xd, ftLastWriteTime.dwLowDateTime=0x1, ftLastWriteTime.dwHighDateTime=0x400, nFileSizeHigh=0x18fb80, nFileSizeLow=0x2, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x2d3c\x7680\x9264\x46\x0a")) returned 0xffffffff [0117.808] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x9acda0 [0117.808] LocalAlloc (uFlags=0x0, uBytes=0x74) returned 0x98f7a0 [0117.808] wcscpy_s (in: _Destination=0x98f7fc, _SizeInWords=0xc, _Source="System.dll" | out: _Destination="System.dll") returned 0x0 [0117.808] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x850a1657, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x850a1657, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x853e749d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x30b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.dll", cAlternateFileName="")) returned 0x9b6908 [0117.808] LocalFree (hMem=0x9acda0) returned 0x0 [0117.808] FindClose (in: hFindFile=0x9b6908 | out: hFindFile=0x9b6908) returned 1 [0117.809] LocalAlloc (uFlags=0x0, uBytes=0x72) returned 0x98f820 [0117.809] LocalFree (hMem=0x98f7a0) returned 0x0 [0117.809] LocalFree (hMem=0x9c6de8) returned 0x0 [0117.809] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0117.809] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x3785c0 [0117.815] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x379448 [0117.819] wcscpy_s (in: _Destination=0x18fbcc, _SizeInWords=0x39, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.dll") returned 0x0 [0117.820] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x9acda0 [0117.821] LocalFree (hMem=0x9acda0) returned 0x0 [0117.822] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x14) returned 0x379670 [0117.827] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x379690 [0117.827] LocalFree (hMem=0x98f820) returned 0x0 [0117.827] LocalFree (hMem=0x9c66a0) returned 0x0 [0117.827] LocalFree (hMem=0x9c6680) returned 0x0 [0117.827] LocalFree (hMem=0x9c6660) returned 0x0 [0117.827] LocalFree (hMem=0x9c66c0) returned 0x0 [0117.827] LocalAlloc (uFlags=0x0, uBytes=0x38) returned 0x9b6908 [0117.827] _wcslwr_s (in: _String="r:System.Drawing.Design.dll", _SizeInWords=0x1c | out: _String="r:system.drawing.design.dll") returned 0x0 [0117.827] wcstok_s (in: _String="r:system.drawing.design.dll", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="r", _Context=0x18fdd4*="system.drawing.design.dll") returned="r" [0117.827] LocalFree (hMem=0x9b6908) returned 0x0 [0117.827] LocalAlloc (uFlags=0x0, uBytes=0x34) returned 0x9b6908 [0117.827] LocalAlloc (uFlags=0x0, uBytes=0x34) returned 0x9b6948 [0117.827] LocalAlloc (uFlags=0x0, uBytes=0x34) returned 0x9b6988 [0117.828] LocalAlloc (uFlags=0x0, uBytes=0x34) returned 0x9b69c8 [0117.828] _wsplitpath_s (in: _FullPath="System.Drawing.Design.dll", _Drive=0x9b6948, _DriveCount=0x1a, _Dir=0x9b6988, _DirCount=0x1a, _Filename=0x9b6908, _FilenameCount=0x1a, _Ext=0x9b69c8, _ExtCount=0x1a | out: _Drive="", _Dir="", _Filename="System.Drawing.Design", _Ext=".dll") returned 0x0 [0117.828] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x9c8708 [0117.828] GetFullPathNameW (in: lpFileName="System.Drawing.Design.dll", nBufferLength=0x104, lpBuffer=0x9c8708, lpFilePart=0x18fb08 | out: lpBuffer="C:\\Windows\\system32\\System.Drawing.Design.dll", lpFilePart=0x18fb08*="System.Drawing.Design.dll") returned 0x2d [0117.828] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\System.Drawing.Design.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x400, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x18fb70, ftLastAccessTime.dwLowDateTime=0x71d12fc9, ftLastAccessTime.dwHighDateTime=0xd, ftLastWriteTime.dwLowDateTime=0x1, ftLastWriteTime.dwHighDateTime=0x2, nFileSizeHigh=0x379688, nFileSizeLow=0x360000, dwReserved0=0x379fe0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x2d3c\x7680\x9264\x46\x19")) returned 0xffffffff [0117.828] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x9acda0 [0117.828] LocalAlloc (uFlags=0x0, uBytes=0x92) returned 0x9a7cf0 [0117.828] wcscpy_s (in: _Destination=0x9a7d4c, _SizeInWords=0x1b, _Source="System.Drawing.Design.dll" | out: _Destination="System.Drawing.Design.dll") returned 0x0 [0117.828] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Drawing.Design.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30fef10, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x30fef10, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xac64c61c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x379fe0, dwReserved1=0x0, cFileName="System.Drawing.Design.dll", cAlternateFileName="")) returned 0x9b6a08 [0117.828] LocalFree (hMem=0x9acda0) returned 0x0 [0117.828] FindClose (in: hFindFile=0x9b6a08 | out: hFindFile=0x9b6a08) returned 1 [0117.828] LocalAlloc (uFlags=0x0, uBytes=0x90) returned 0x9c8920 [0117.828] LocalFree (hMem=0x9a7cf0) returned 0x0 [0117.828] LocalFree (hMem=0x9c8708) returned 0x0 [0117.828] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0117.828] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x3796a0 [0117.848] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x37a528 [0117.853] CoTaskMemAlloc (cb=0x90) returned 0x9c8850 [0117.854] wcscpy_s (in: _Destination=0x9c8850, _SizeInWords=0x48, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Drawing.Design.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Drawing.Design.dll") returned 0x0 [0117.855] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x9acda0 [0117.855] LocalFree (hMem=0x9acda0) returned 0x0 [0117.857] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xa4) returned 0x37a750 [0117.857] CoTaskMemFree (pv=0x9c8850) [0117.857] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x37a800 [0117.857] LocalFree (hMem=0x9c8920) returned 0x0 [0117.857] LocalFree (hMem=0x9b6988) returned 0x0 [0117.857] LocalFree (hMem=0x9b6948) returned 0x0 [0117.857] LocalFree (hMem=0x9b6908) returned 0x0 [0117.857] LocalFree (hMem=0x9b69c8) returned 0x0 [0117.857] LocalAlloc (uFlags=0x0, uBytes=0x2a) returned 0x99df40 [0117.857] _wcslwr_s (in: _String="r:System.Drawing.dll", _SizeInWords=0x15 | out: _String="r:system.drawing.dll") returned 0x0 [0117.857] wcstok_s (in: _String="r:system.drawing.dll", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="r", _Context=0x18fdd4*="system.drawing.dll") returned="r" [0117.858] LocalFree (hMem=0x99df40) returned 0x0 [0117.858] LocalAlloc (uFlags=0x0, uBytes=0x26) returned 0x9a72f0 [0117.858] LocalAlloc (uFlags=0x0, uBytes=0x26) returned 0x9a7320 [0117.858] LocalAlloc (uFlags=0x0, uBytes=0x26) returned 0x9a7290 [0117.858] LocalAlloc (uFlags=0x0, uBytes=0x26) returned 0x9a72c0 [0117.858] _wsplitpath_s (in: _FullPath="System.Drawing.dll", _Drive=0x9a7320, _DriveCount=0x13, _Dir=0x9a7290, _DirCount=0x13, _Filename=0x9a72f0, _FilenameCount=0x13, _Ext=0x9a72c0, _ExtCount=0x13 | out: _Drive="", _Dir="", _Filename="System.Drawing", _Ext=".dll") returned 0x0 [0117.858] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x9ca2d8 [0117.858] GetFullPathNameW (in: lpFileName="System.Drawing.dll", nBufferLength=0x104, lpBuffer=0x9ca2d8, lpFilePart=0x18fb08 | out: lpBuffer="C:\\Windows\\system32\\System.Drawing.dll", lpFilePart=0x18fb08*="System.Drawing.dll") returned 0x26 [0117.858] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\System.Drawing.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x400, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x18fb70, ftLastAccessTime.dwLowDateTime=0x71d12fc9, ftLastAccessTime.dwHighDateTime=0xd, ftLastWriteTime.dwLowDateTime=0x1, ftLastWriteTime.dwHighDateTime=0x2, nFileSizeHigh=0x37a7f8, nFileSizeLow=0x360000, dwReserved0=0x37afe0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x2d3c\x7680\x9264\x46\x12")) returned 0xffffffff [0117.858] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x9acda0 [0117.858] LocalAlloc (uFlags=0x0, uBytes=0x84) returned 0x9a7cf0 [0117.858] wcscpy_s (in: _Destination=0x9a7d4c, _SizeInWords=0x14, _Source="System.Drawing.dll" | out: _Destination="System.Drawing.dll") returned 0x0 [0117.858] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Drawing.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93975fe4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93975fe4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9399c144, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x99000, dwReserved0=0x37afe0, dwReserved1=0x0, cFileName="System.Drawing.dll", cAlternateFileName="")) returned 0x9b69c8 [0117.858] LocalFree (hMem=0x9acda0) returned 0x0 [0117.858] FindClose (in: hFindFile=0x9b69c8 | out: hFindFile=0x9b69c8) returned 1 [0117.858] LocalAlloc (uFlags=0x0, uBytes=0x82) returned 0x9a7d80 [0117.858] LocalFree (hMem=0x9a7cf0) returned 0x0 [0117.858] LocalFree (hMem=0x9ca2d8) returned 0x0 [0117.859] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0117.859] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x37a810 [0117.859] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x37b698 [0117.863] CoTaskMemAlloc (cb=0x82) returned 0x9a7cf0 [0117.863] wcscpy_s (in: _Destination=0x9a7cf0, _SizeInWords=0x41, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Drawing.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Drawing.dll") returned 0x0 [0117.864] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x9acda0 [0117.865] LocalFree (hMem=0x9acda0) returned 0x0 [0117.868] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xa4) returned 0x37b8c0 [0117.871] CoTaskMemFree (pv=0x9a7cf0) [0117.871] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x37b970 [0117.871] LocalFree (hMem=0x9a7d80) returned 0x0 [0117.871] LocalFree (hMem=0x9a7290) returned 0x0 [0117.871] LocalFree (hMem=0x9a7320) returned 0x0 [0117.871] LocalFree (hMem=0x9a72f0) returned 0x0 [0117.871] LocalFree (hMem=0x9a72c0) returned 0x0 [0117.871] LocalAlloc (uFlags=0x0, uBytes=0x40) returned 0x994ec8 [0117.871] _wcslwr_s (in: _String="r:System.EnterpriseServices.dll", _SizeInWords=0x20 | out: _String="r:system.enterpriseservices.dll") returned 0x0 [0117.871] wcstok_s (in: _String="r:system.enterpriseservices.dll", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="r", _Context=0x18fdd4*="system.enterpriseservices.dll") returned="r" [0117.871] LocalFree (hMem=0x994ec8) returned 0x0 [0117.871] LocalAlloc (uFlags=0x0, uBytes=0x3c) returned 0x994ec8 [0117.871] LocalAlloc (uFlags=0x0, uBytes=0x3c) returned 0x994f10 [0117.871] LocalAlloc (uFlags=0x0, uBytes=0x3c) returned 0x994e38 [0117.871] LocalAlloc (uFlags=0x0, uBytes=0x3c) returned 0x994e80 [0117.872] _wsplitpath_s (in: _FullPath="System.EnterpriseServices.dll", _Drive=0x994f10, _DriveCount=0x1e, _Dir=0x994e38, _DirCount=0x1e, _Filename=0x994ec8, _FilenameCount=0x1e, _Ext=0x994e80, _ExtCount=0x1e | out: _Drive="", _Dir="", _Filename="System.EnterpriseServices", _Ext=".dll") returned 0x0 [0117.872] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x9cbbf8 [0117.872] GetFullPathNameW (in: lpFileName="System.EnterpriseServices.dll", nBufferLength=0x104, lpBuffer=0x9cbbf8, lpFilePart=0x18fb08 | out: lpBuffer="C:\\Windows\\system32\\System.EnterpriseServices.dll", lpFilePart=0x18fb08*="System.EnterpriseServices.dll") returned 0x31 [0117.872] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\System.EnterpriseServices.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x400, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x18fb70, ftLastAccessTime.dwLowDateTime=0x71d12fc9, ftLastAccessTime.dwHighDateTime=0xd, ftLastWriteTime.dwLowDateTime=0x1, ftLastWriteTime.dwHighDateTime=0x2, nFileSizeHigh=0x37b968, nFileSizeLow=0x360000, dwReserved0=0x37bfe0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x2d3c\x7680\x9264\x46\x1d")) returned 0xffffffff [0117.885] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x9acda0 [0117.885] LocalAlloc (uFlags=0x0, uBytes=0x9a) returned 0x9a7cf0 [0117.885] wcscpy_s (in: _Destination=0x9a7d4c, _SizeInWords=0x1f, _Source="System.EnterpriseServices.dll" | out: _Destination="System.EnterpriseServices.dll") returned 0x0 [0117.885] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.EnterpriseServices.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e5d9a8a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8e5d9a8a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8e5ffbea, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x37bfe0, dwReserved1=0x0, cFileName="System.EnterpriseServices.dll", cAlternateFileName="")) returned 0x9b69c8 [0117.886] LocalFree (hMem=0x9acda0) returned 0x0 [0117.886] FindClose (in: hFindFile=0x9b69c8 | out: hFindFile=0x9b69c8) returned 1 [0117.886] LocalAlloc (uFlags=0x0, uBytes=0x98) returned 0x9cbe10 [0117.886] LocalFree (hMem=0x9a7cf0) returned 0x0 [0117.886] LocalFree (hMem=0x9cbbf8) returned 0x0 [0117.886] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0117.886] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x37b980 [0117.886] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x37c808 [0117.897] CoTaskMemAlloc (cb=0x98) returned 0x9cbd40 [0117.897] wcscpy_s (in: _Destination=0x9cbd40, _SizeInWords=0x4c, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.EnterpriseServices.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.EnterpriseServices.dll") returned 0x0 [0117.898] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x9acda0 [0117.898] LocalFree (hMem=0x9acda0) returned 0x0 [0117.900] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x37ca30 [0117.953] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xa4) returned 0x37cc58 [0117.956] CoTaskMemFree (pv=0x9cbd40) [0117.956] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x37cd08 [0117.956] LocalFree (hMem=0x9cbe10) returned 0x0 [0117.956] LocalFree (hMem=0x994e38) returned 0x0 [0117.956] LocalFree (hMem=0x994f10) returned 0x0 [0117.956] LocalFree (hMem=0x994ec8) returned 0x0 [0117.956] LocalFree (hMem=0x994e80) returned 0x0 [0117.956] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x99df40 [0117.956] _wcslwr_s (in: _String="r:System.Management.dll", _SizeInWords=0x18 | out: _String="r:system.management.dll") returned 0x0 [0117.956] wcstok_s (in: _String="r:system.management.dll", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="r", _Context=0x18fdd4*="system.management.dll") returned="r" [0117.956] LocalFree (hMem=0x99df40) returned 0x0 [0117.956] LocalAlloc (uFlags=0x0, uBytes=0x2c) returned 0x99df40 [0117.956] LocalAlloc (uFlags=0x0, uBytes=0x2c) returned 0x99df78 [0117.956] LocalAlloc (uFlags=0x0, uBytes=0x2c) returned 0x99ded0 [0117.956] LocalAlloc (uFlags=0x0, uBytes=0x2c) returned 0x99df08 [0117.956] _wsplitpath_s (in: _FullPath="System.Management.dll", _Drive=0x99df78, _DriveCount=0x16, _Dir=0x99ded0, _DirCount=0x16, _Filename=0x99df40, _FilenameCount=0x16, _Ext=0x99df08, _ExtCount=0x16 | out: _Drive="", _Dir="", _Filename="System.Management", _Ext=".dll") returned 0x0 [0117.956] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x9d18f0 [0117.956] GetFullPathNameW (in: lpFileName="System.Management.dll", nBufferLength=0x104, lpBuffer=0x9d18f0, lpFilePart=0x18fb08 | out: lpBuffer="C:\\Windows\\system32\\System.Management.dll", lpFilePart=0x18fb08*="System.Management.dll") returned 0x29 [0117.956] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\System.Management.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x26000001, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x18fb70, ftLastAccessTime.dwLowDateTime=0x71d12fc9, ftLastAccessTime.dwHighDateTime=0xd, ftLastWriteTime.dwLowDateTime=0x1, ftLastWriteTime.dwHighDateTime=0x2, nFileSizeHigh=0x37cd00, nFileSizeLow=0x360000, dwReserved0=0x37cfe0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x2d3c\x7680\x9264\x46\x15")) returned 0xffffffff [0117.957] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x9acda0 [0117.957] LocalAlloc (uFlags=0x0, uBytes=0x8a) returned 0x9a7cf0 [0117.957] wcscpy_s (in: _Destination=0x9a7d4c, _SizeInWords=0x17, _Source="System.Management.dll" | out: _Destination="System.Management.dll") returned 0x0 [0117.957] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Management.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99032224, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99032224, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99058384, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5e000, dwReserved0=0x37cfe0, dwReserved1=0x0, cFileName="System.Management.dll", cAlternateFileName="")) returned 0x9b69c8 [0117.957] LocalFree (hMem=0x9acda0) returned 0x0 [0117.957] FindClose (in: hFindFile=0x9b69c8 | out: hFindFile=0x9b69c8) returned 1 [0117.957] LocalAlloc (uFlags=0x0, uBytes=0x88) returned 0x9cbd40 [0117.957] LocalFree (hMem=0x9a7cf0) returned 0x0 [0117.957] LocalFree (hMem=0x9d18f0) returned 0x0 [0117.957] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0117.957] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x37cd18 [0117.981] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x37dba0 [0117.988] CoTaskMemAlloc (cb=0x88) returned 0x9cbdd0 [0117.988] wcscpy_s (in: _Destination=0x9cbdd0, _SizeInWords=0x44, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Management.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Management.dll") returned 0x0 [0117.989] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x9acda0 [0117.990] LocalFree (hMem=0x9acda0) returned 0x0 [0117.992] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xa4) returned 0x37ddc8 [0117.994] CoTaskMemFree (pv=0x9cbdd0) [0117.994] RtlReAllocateHeap (Heap=0x360000, Flags=0x0, Ptr=0x375118, Size=0x100) returned 0x37de78 [0117.994] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x37df80 [0117.994] LocalFree (hMem=0x9cbd40) returned 0x0 [0117.994] LocalFree (hMem=0x99ded0) returned 0x0 [0117.994] LocalFree (hMem=0x99df78) returned 0x0 [0117.994] LocalFree (hMem=0x99df40) returned 0x0 [0117.994] LocalFree (hMem=0x99df08) returned 0x0 [0117.994] LocalAlloc (uFlags=0x0, uBytes=0x2e) returned 0x99df08 [0117.994] _wcslwr_s (in: _String="r:System.Messaging.dll", _SizeInWords=0x17 | out: _String="r:system.messaging.dll") returned 0x0 [0117.994] wcstok_s (in: _String="r:system.messaging.dll", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="r", _Context=0x18fdd4*="system.messaging.dll") returned="r" [0117.994] LocalFree (hMem=0x99df08) returned 0x0 [0117.995] LocalAlloc (uFlags=0x0, uBytes=0x2a) returned 0x99df08 [0117.995] LocalAlloc (uFlags=0x0, uBytes=0x2a) returned 0x99df40 [0117.995] LocalAlloc (uFlags=0x0, uBytes=0x2a) returned 0x99df78 [0117.995] LocalAlloc (uFlags=0x0, uBytes=0x2a) returned 0x99ded0 [0117.995] _wsplitpath_s (in: _FullPath="System.Messaging.dll", _Drive=0x99df40, _DriveCount=0x15, _Dir=0x99df78, _DirCount=0x15, _Filename=0x99df08, _FilenameCount=0x15, _Ext=0x99ded0, _ExtCount=0x15 | out: _Drive="", _Dir="", _Filename="System.Messaging", _Ext=".dll") returned 0x0 [0117.995] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x9f98f0 [0117.995] GetFullPathNameW (in: lpFileName="System.Messaging.dll", nBufferLength=0x104, lpBuffer=0x9f98f0, lpFilePart=0x18fb08 | out: lpBuffer="C:\\Windows\\system32\\System.Messaging.dll", lpFilePart=0x18fb08*="System.Messaging.dll") returned 0x28 [0117.995] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\System.Messaging.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x76ef3472, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x375118, ftLastAccessTime.dwLowDateTime=0x80, ftLastAccessTime.dwHighDateTime=0x37de78, ftLastWriteTime.dwLowDateTime=0x100, ftLastWriteTime.dwHighDateTime=0x2, nFileSizeHigh=0x37df78, nFileSizeLow=0x360000, dwReserved0=0x37dfe0, dwReserved1=0x7, cFileName="ℵ盰鳖盤", cAlternateFileName="\x2d3c\x7680\x9264\x46\x14")) returned 0xffffffff [0117.995] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x9acda0 [0117.995] LocalAlloc (uFlags=0x0, uBytes=0x88) returned 0x9a7cf0 [0117.995] wcscpy_s (in: _Destination=0x9a7d4c, _SizeInWords=0x16, _Source="System.Messaging.dll" | out: _Destination="System.Messaging.dll") returned 0x0 [0117.995] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Messaging.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af7031d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9af7031d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9af9647e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x37dfe0, dwReserved1=0x7, cFileName="System.Messaging.dll", cAlternateFileName="")) returned 0x9b69c8 [0117.996] LocalFree (hMem=0x9acda0) returned 0x0 [0117.996] FindClose (in: hFindFile=0x9b69c8 | out: hFindFile=0x9b69c8) returned 1 [0117.996] LocalAlloc (uFlags=0x0, uBytes=0x86) returned 0x9a7d80 [0117.996] LocalFree (hMem=0x9a7cf0) returned 0x0 [0117.996] LocalFree (hMem=0x9f98f0) returned 0x0 [0117.996] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0117.996] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x37df90 [0118.001] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x37ee18 [0118.007] CoTaskMemAlloc (cb=0x86) returned 0x9a7cf0 [0118.007] wcscpy_s (in: _Destination=0x9a7cf0, _SizeInWords=0x43, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Messaging.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Messaging.dll") returned 0x0 [0118.008] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x9acda0 [0118.009] LocalFree (hMem=0x9acda0) returned 0x0 [0118.010] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xa4) returned 0x37f040 [0118.012] CoTaskMemFree (pv=0x9a7cf0) [0118.012] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x375118 [0118.012] LocalFree (hMem=0x9a7d80) returned 0x0 [0118.012] LocalFree (hMem=0x99df78) returned 0x0 [0118.012] LocalFree (hMem=0x99df40) returned 0x0 [0118.012] LocalFree (hMem=0x99df08) returned 0x0 [0118.012] LocalFree (hMem=0x99ded0) returned 0x0 [0118.012] LocalAlloc (uFlags=0x0, uBytes=0x3c) returned 0x994e80 [0118.012] _wcslwr_s (in: _String="r:System.Runtime.Remoting.dll", _SizeInWords=0x1e | out: _String="r:system.runtime.remoting.dll") returned 0x0 [0118.012] wcstok_s (in: _String="r:system.runtime.remoting.dll", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="r", _Context=0x18fdd4*="system.runtime.remoting.dll") returned="r" [0118.012] LocalFree (hMem=0x994e80) returned 0x0 [0118.012] LocalAlloc (uFlags=0x0, uBytes=0x38) returned 0x9b69c8 [0118.013] LocalAlloc (uFlags=0x0, uBytes=0x38) returned 0x9b6908 [0118.013] LocalAlloc (uFlags=0x0, uBytes=0x38) returned 0x9b6948 [0118.013] LocalAlloc (uFlags=0x0, uBytes=0x38) returned 0x9b6988 [0118.013] _wsplitpath_s (in: _FullPath="System.Runtime.Remoting.dll", _Drive=0x9b6908, _DriveCount=0x1c, _Dir=0x9b6948, _DirCount=0x1c, _Filename=0x9b69c8, _FilenameCount=0x1c, _Ext=0x9b6988, _ExtCount=0x1c | out: _Drive="", _Dir="", _Filename="System.Runtime.Remoting", _Ext=".dll") returned 0x0 [0118.013] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x9f98f0 [0118.013] GetFullPathNameW (in: lpFileName="System.Runtime.Remoting.dll", nBufferLength=0x104, lpBuffer=0x9f98f0, lpFilePart=0x18fb08 | out: lpBuffer="C:\\Windows\\system32\\System.Runtime.Remoting.dll", lpFilePart=0x18fb08*="System.Runtime.Remoting.dll") returned 0x2f [0118.013] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\System.Runtime.Remoting.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x400, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x18fb70, ftLastAccessTime.dwLowDateTime=0x71d12fc9, ftLastAccessTime.dwHighDateTime=0xd, ftLastWriteTime.dwLowDateTime=0x1, ftLastWriteTime.dwHighDateTime=0x2, nFileSizeHigh=0x375110, nFileSizeLow=0x360000, dwReserved0=0x375198, dwReserved1=0x0, cFileName="", cAlternateFileName="\x2d3c\x7680\x9264\x46\x1b")) returned 0xffffffff [0118.013] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x9acda0 [0118.013] LocalAlloc (uFlags=0x0, uBytes=0x96) returned 0x9a7cf0 [0118.013] wcscpy_s (in: _Destination=0x9a7d4c, _SizeInWords=0x1d, _Source="System.Runtime.Remoting.dll" | out: _Destination="System.Runtime.Remoting.dll") returned 0x0 [0118.013] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Runtime.Remoting.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830cafdd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830cafdd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830f113d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x375198, dwReserved1=0x0, cFileName="System.Runtime.Remoting.dll", cAlternateFileName="")) returned 0x9b6a08 [0118.013] LocalFree (hMem=0x9acda0) returned 0x0 [0118.013] FindClose (in: hFindFile=0x9b6a08 | out: hFindFile=0x9b6a08) returned 1 [0118.013] LocalAlloc (uFlags=0x0, uBytes=0x94) returned 0x9cbd40 [0118.013] LocalFree (hMem=0x9a7cf0) returned 0x0 [0118.013] LocalFree (hMem=0x9f98f0) returned 0x0 [0118.013] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0118.013] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x37f0f0 [0118.013] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x37ff78 [0118.023] CoTaskMemAlloc (cb=0x94) returned 0x9cbde0 [0118.023] wcscpy_s (in: _Destination=0x9cbde0, _SizeInWords=0x4a, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Runtime.Remoting.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Runtime.Remoting.dll") returned 0x0 [0118.023] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x9acda0 [0118.024] LocalFree (hMem=0x9acda0) returned 0x0 [0118.026] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x14) returned 0x375128 [0118.028] CoTaskMemFree (pv=0x9cbde0) [0118.028] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x375148 [0118.028] LocalFree (hMem=0x9cbd40) returned 0x0 [0118.028] LocalFree (hMem=0x9b6948) returned 0x0 [0118.028] LocalFree (hMem=0x9b6908) returned 0x0 [0118.028] LocalFree (hMem=0x9b69c8) returned 0x0 [0118.028] LocalFree (hMem=0x9b6988) returned 0x0 [0118.028] LocalAlloc (uFlags=0x0, uBytes=0x66) returned 0x99ef60 [0118.028] _wcslwr_s (in: _String="r:System.Runtime.Serialization.Formatters.Soap.dll", _SizeInWords=0x33 | out: _String="r:system.runtime.serialization.formatters.soap.dll") returned 0x0 [0118.028] wcstok_s (in: _String="r:system.runtime.serialization.formatters.soap.dll", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="r", _Context=0x18fdd4*="system.runtime.serialization.formatters.soap.dll") returned="r" [0118.028] LocalFree (hMem=0x99ef60) returned 0x0 [0118.028] LocalAlloc (uFlags=0x0, uBytes=0x62) returned 0x99ef60 [0118.028] LocalAlloc (uFlags=0x0, uBytes=0x62) returned 0x9a7cf0 [0118.028] LocalAlloc (uFlags=0x0, uBytes=0x62) returned 0x9a7d60 [0118.028] LocalAlloc (uFlags=0x0, uBytes=0x62) returned 0x9cbd40 [0118.028] _wsplitpath_s (in: _FullPath="System.Runtime.Serialization.Formatters.Soap.dll", _Drive=0x9a7cf0, _DriveCount=0x31, _Dir=0x9a7d60, _DirCount=0x31, _Filename=0x99ef60, _FilenameCount=0x31, _Ext=0x9cbd40, _ExtCount=0x31 | out: _Drive="", _Dir="", _Filename="System.Runtime.Serialization.Formatters.Soap", _Ext=".dll") returned 0x0 [0118.028] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x9f98f0 [0118.028] GetFullPathNameW (in: lpFileName="System.Runtime.Serialization.Formatters.Soap.dll", nBufferLength=0x104, lpBuffer=0x9f98f0, lpFilePart=0x18fb08 | out: lpBuffer="C:\\Windows\\system32\\System.Runtime.Serialization.Formatters.Soap.dll", lpFilePart=0x18fb08*="System.Runtime.Serialization.Formatters.Soap.dll") returned 0x44 [0118.028] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\System.Runtime.Serialization.Formatters.Soap.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x400, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x18fb70, ftLastAccessTime.dwLowDateTime=0x71d12fc9, ftLastAccessTime.dwHighDateTime=0xd, ftLastWriteTime.dwLowDateTime=0x1, ftLastWriteTime.dwHighDateTime=0x2, nFileSizeHigh=0x375140, nFileSizeLow=0x360000, dwReserved0=0x375198, dwReserved1=0x0, cFileName="", cAlternateFileName="\x2d3c\x7680\x9264\x46\x30")) returned 0xffffffff [0118.029] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x9acda0 [0118.029] LocalAlloc (uFlags=0x0, uBytes=0xc0) returned 0x9cbdb0 [0118.029] wcscpy_s (in: _Destination=0x9cbe0c, _SizeInWords=0x32, _Source="System.Runtime.Serialization.Formatters.Soap.dll" | out: _Destination="System.Runtime.Serialization.Formatters.Soap.dll") returned 0x0 [0118.029] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Runtime.Serialization.Formatters.Soap.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c275e5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x3c275e5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xacde2c3c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x375198, dwReserved1=0x0, cFileName="System.Runtime.Serialization.Formatters.Soap.dll", cAlternateFileName="")) returned 0x9b6988 [0118.029] LocalFree (hMem=0x9acda0) returned 0x0 [0118.029] FindClose (in: hFindFile=0x9b6988 | out: hFindFile=0x9b6988) returned 1 [0118.029] LocalAlloc (uFlags=0x0, uBytes=0xbe) returned 0x9f9b08 [0118.029] LocalFree (hMem=0x9cbdb0) returned 0x0 [0118.029] LocalFree (hMem=0x9f98f0) returned 0x0 [0118.029] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0118.029] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x3801a0 [0118.037] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x381028 [0118.043] CoTaskMemAlloc (cb=0xbe) returned 0x9cbdb0 [0118.043] wcscpy_s (in: _Destination=0x9cbdb0, _SizeInWords=0x5f, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Runtime.Serialization.Formatters.Soap.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Runtime.Serialization.Formatters.Soap.dll") returned 0x0 [0118.044] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x9acda0 [0118.044] LocalFree (hMem=0x9acda0) returned 0x0 [0118.045] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xa4) returned 0x381250 [0118.046] CoTaskMemFree (pv=0x9cbdb0) [0118.046] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x375158 [0118.046] LocalFree (hMem=0x9f9b08) returned 0x0 [0118.046] LocalFree (hMem=0x9a7d60) returned 0x0 [0118.046] LocalFree (hMem=0x9a7cf0) returned 0x0 [0118.046] LocalFree (hMem=0x99ef60) returned 0x0 [0118.046] LocalFree (hMem=0x9cbd40) returned 0x0 [0118.046] LocalAlloc (uFlags=0x0, uBytes=0x2c) returned 0x99ded0 [0118.046] _wcslwr_s (in: _String="r:System.Security.dll", _SizeInWords=0x16 | out: _String="r:system.security.dll") returned 0x0 [0118.046] wcstok_s (in: _String="r:system.security.dll", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="r", _Context=0x18fdd4*="system.security.dll") returned="r" [0118.046] LocalFree (hMem=0x99ded0) returned 0x0 [0118.046] LocalAlloc (uFlags=0x0, uBytes=0x28) returned 0x9a72c0 [0118.046] LocalAlloc (uFlags=0x0, uBytes=0x28) returned 0x9a72f0 [0118.046] LocalAlloc (uFlags=0x0, uBytes=0x28) returned 0x9a7320 [0118.046] LocalAlloc (uFlags=0x0, uBytes=0x28) returned 0x9a7290 [0118.046] _wsplitpath_s (in: _FullPath="System.Security.dll", _Drive=0x9a72f0, _DriveCount=0x14, _Dir=0x9a7320, _DirCount=0x14, _Filename=0x9a72c0, _FilenameCount=0x14, _Ext=0x9a7290, _ExtCount=0x14 | out: _Drive="", _Dir="", _Filename="System.Security", _Ext=".dll") returned 0x0 [0118.046] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x9f98f0 [0118.046] GetFullPathNameW (in: lpFileName="System.Security.dll", nBufferLength=0x104, lpBuffer=0x9f98f0, lpFilePart=0x18fb08 | out: lpBuffer="C:\\Windows\\system32\\System.Security.dll", lpFilePart=0x18fb08*="System.Security.dll") returned 0x27 [0118.046] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\System.Security.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x400, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x18fb70, ftLastAccessTime.dwLowDateTime=0x71d12fc9, ftLastAccessTime.dwHighDateTime=0xd, ftLastWriteTime.dwLowDateTime=0x1, ftLastWriteTime.dwHighDateTime=0x2, nFileSizeHigh=0x375150, nFileSizeLow=0x360000, dwReserved0=0x375198, dwReserved1=0x0, cFileName="", cAlternateFileName="\x2d3c\x7680\x9264\x46\x13")) returned 0xffffffff [0118.046] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x9acda0 [0118.046] LocalAlloc (uFlags=0x0, uBytes=0x86) returned 0x9f9b08 [0118.046] wcscpy_s (in: _Destination=0x9f9b64, _SizeInWords=0x15, _Source="System.Security.dll" | out: _Destination="System.Security.dll") returned 0x0 [0118.046] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Security.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fa155af, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8fa155af, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8fa155af, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x375198, dwReserved1=0x0, cFileName="System.Security.dll", cAlternateFileName="")) returned 0x9b6988 [0118.047] LocalFree (hMem=0x9acda0) returned 0x0 [0118.047] FindClose (in: hFindFile=0x9b6988 | out: hFindFile=0x9b6988) returned 1 [0118.047] LocalAlloc (uFlags=0x0, uBytes=0x84) returned 0x9a7cf0 [0118.047] LocalFree (hMem=0x9f9b08) returned 0x0 [0118.047] LocalFree (hMem=0x9f98f0) returned 0x0 [0118.047] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0118.047] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x381300 [0118.048] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x382188 [0118.053] CoTaskMemAlloc (cb=0x84) returned 0x9a7d80 [0118.053] wcscpy_s (in: _Destination=0x9a7d80, _SizeInWords=0x42, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Security.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Security.dll") returned 0x0 [0118.053] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x9acda0 [0118.054] LocalFree (hMem=0x9acda0) returned 0x0 [0118.055] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xa4) returned 0x3823b0 [0118.057] CoTaskMemFree (pv=0x9a7d80) [0118.057] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x375168 [0118.058] LocalFree (hMem=0x9a7cf0) returned 0x0 [0118.058] LocalFree (hMem=0x9a7320) returned 0x0 [0118.058] LocalFree (hMem=0x9a72f0) returned 0x0 [0118.058] LocalFree (hMem=0x9a72c0) returned 0x0 [0118.058] LocalFree (hMem=0x9a7290) returned 0x0 [0118.058] LocalAlloc (uFlags=0x0, uBytes=0x38) returned 0x9b6988 [0118.058] _wcslwr_s (in: _String="r:System.ServiceProcess.dll", _SizeInWords=0x1c | out: _String="r:system.serviceprocess.dll") returned 0x0 [0118.058] wcstok_s (in: _String="r:system.serviceprocess.dll", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="r", _Context=0x18fdd4*="system.serviceprocess.dll") returned="r" [0118.058] LocalFree (hMem=0x9b6988) returned 0x0 [0118.058] LocalAlloc (uFlags=0x0, uBytes=0x34) returned 0x9b6988 [0118.058] LocalAlloc (uFlags=0x0, uBytes=0x34) returned 0x9b69c8 [0118.058] LocalAlloc (uFlags=0x0, uBytes=0x34) returned 0x9b6908 [0118.058] LocalAlloc (uFlags=0x0, uBytes=0x34) returned 0x9b6948 [0118.058] _wsplitpath_s (in: _FullPath="System.ServiceProcess.dll", _Drive=0x9b69c8, _DriveCount=0x1a, _Dir=0x9b6908, _DirCount=0x1a, _Filename=0x9b6988, _FilenameCount=0x1a, _Ext=0x9b6948, _ExtCount=0x1a | out: _Drive="", _Dir="", _Filename="System.ServiceProcess", _Ext=".dll") returned 0x0 [0118.058] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x9f98f0 [0118.058] GetFullPathNameW (in: lpFileName="System.ServiceProcess.dll", nBufferLength=0x104, lpBuffer=0x9f98f0, lpFilePart=0x18fb08 | out: lpBuffer="C:\\Windows\\system32\\System.ServiceProcess.dll", lpFilePart=0x18fb08*="System.ServiceProcess.dll") returned 0x2d [0118.059] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\System.ServiceProcess.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x400, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x18fb70, ftLastAccessTime.dwLowDateTime=0x71d12fc9, ftLastAccessTime.dwHighDateTime=0xd, ftLastWriteTime.dwLowDateTime=0x1, ftLastWriteTime.dwHighDateTime=0x2, nFileSizeHigh=0x375160, nFileSizeLow=0x360000, dwReserved0=0x375198, dwReserved1=0x0, cFileName="", cAlternateFileName="\x2d3c\x7680\x9264\x46\x19")) returned 0xffffffff [0118.059] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x9acda0 [0118.059] LocalAlloc (uFlags=0x0, uBytes=0x92) returned 0x9f9b08 [0118.059] wcscpy_s (in: _Destination=0x9f9b64, _SizeInWords=0x1b, _Source="System.ServiceProcess.dll" | out: _Destination="System.ServiceProcess.dll") returned 0x0 [0118.059] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.ServiceProcess.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87d6948a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x87d6948a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87d6948a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x375198, dwReserved1=0x0, cFileName="System.ServiceProcess.dll", cAlternateFileName="")) returned 0x9b6a08 [0118.059] LocalFree (hMem=0x9acda0) returned 0x0 [0118.059] FindClose (in: hFindFile=0x9b6a08 | out: hFindFile=0x9b6a08) returned 1 [0118.059] LocalAlloc (uFlags=0x0, uBytes=0x90) returned 0x9a7cf0 [0118.059] LocalFree (hMem=0x9f9b08) returned 0x0 [0118.059] LocalFree (hMem=0x9f98f0) returned 0x0 [0118.059] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0118.059] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x382460 [0118.065] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x3832e8 [0118.106] CoTaskMemAlloc (cb=0x90) returned 0x9cbd40 [0118.106] wcscpy_s (in: _Destination=0x9cbd40, _SizeInWords=0x48, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.ServiceProcess.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.ServiceProcess.dll") returned 0x0 [0118.106] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x9acda0 [0118.107] LocalFree (hMem=0x9acda0) returned 0x0 [0118.108] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xa4) returned 0x383510 [0118.109] CoTaskMemFree (pv=0x9cbd40) [0118.109] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x375178 [0118.109] LocalFree (hMem=0x9a7cf0) returned 0x0 [0118.109] LocalFree (hMem=0x9b6908) returned 0x0 [0118.109] LocalFree (hMem=0x9b69c8) returned 0x0 [0118.109] LocalFree (hMem=0x9b6988) returned 0x0 [0118.109] LocalFree (hMem=0x9b6948) returned 0x0 [0118.109] LocalAlloc (uFlags=0x0, uBytes=0x34) returned 0x9b6948 [0118.109] _wcslwr_s (in: _String="r:System.Transactions.dll", _SizeInWords=0x1a | out: _String="r:system.transactions.dll") returned 0x0 [0118.109] wcstok_s (in: _String="r:system.transactions.dll", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="r", _Context=0x18fdd4*="system.transactions.dll") returned="r" [0118.109] LocalFree (hMem=0x9b6948) returned 0x0 [0118.109] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x99ded0 [0118.109] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x99df08 [0118.109] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x99df40 [0118.109] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x99df78 [0118.109] _wsplitpath_s (in: _FullPath="System.Transactions.dll", _Drive=0x99df08, _DriveCount=0x18, _Dir=0x99df40, _DirCount=0x18, _Filename=0x99ded0, _FilenameCount=0x18, _Ext=0x99df78, _ExtCount=0x18 | out: _Drive="", _Dir="", _Filename="System.Transactions", _Ext=".dll") returned 0x0 [0118.109] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x9f98f0 [0118.109] GetFullPathNameW (in: lpFileName="System.Transactions.dll", nBufferLength=0x104, lpBuffer=0x9f98f0, lpFilePart=0x18fb08 | out: lpBuffer="C:\\Windows\\system32\\System.Transactions.dll", lpFilePart=0x18fb08*="System.Transactions.dll") returned 0x2b [0118.109] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\System.Transactions.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x400, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x18fb70, ftLastAccessTime.dwLowDateTime=0x71d12fc9, ftLastAccessTime.dwHighDateTime=0xd, ftLastWriteTime.dwLowDateTime=0x1, ftLastWriteTime.dwHighDateTime=0x2, nFileSizeHigh=0x375170, nFileSizeLow=0x360000, dwReserved0=0x375198, dwReserved1=0x0, cFileName="", cAlternateFileName="\x2d3c\x7680\x9264\x46\x17")) returned 0xffffffff [0118.110] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x9acda0 [0118.110] LocalAlloc (uFlags=0x0, uBytes=0x8e) returned 0x9f9b08 [0118.110] wcscpy_s (in: _Destination=0x9f9b64, _SizeInWords=0x19, _Source="System.Transactions.dll" | out: _Destination="System.Transactions.dll") returned 0x0 [0118.110] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Transactions.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4051c49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x4051c49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xacf3989c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3fe00, dwReserved0=0x375198, dwReserved1=0x0, cFileName="System.Transactions.dll", cAlternateFileName="")) returned 0x9b6948 [0118.110] LocalFree (hMem=0x9acda0) returned 0x0 [0118.110] FindClose (in: hFindFile=0x9b6948 | out: hFindFile=0x9b6948) returned 1 [0118.110] LocalAlloc (uFlags=0x0, uBytes=0x8c) returned 0x9a7cf0 [0118.110] LocalFree (hMem=0x9f9b08) returned 0x0 [0118.110] LocalFree (hMem=0x9f98f0) returned 0x0 [0118.110] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0118.110] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x3835c0 [0118.112] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x384448 [0118.115] CoTaskMemAlloc (cb=0x8c) returned 0x9cbd40 [0118.115] wcscpy_s (in: _Destination=0x9cbd40, _SizeInWords=0x46, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Transactions.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Transactions.dll") returned 0x0 [0118.116] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x9acda0 [0118.117] LocalFree (hMem=0x9acda0) returned 0x0 [0118.118] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x14) returned 0x384670 [0118.120] CoTaskMemFree (pv=0x9cbd40) [0118.120] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x375188 [0118.120] LocalFree (hMem=0x9a7cf0) returned 0x0 [0118.120] LocalFree (hMem=0x99df40) returned 0x0 [0118.120] LocalFree (hMem=0x99df08) returned 0x0 [0118.120] LocalFree (hMem=0x99ded0) returned 0x0 [0118.120] LocalFree (hMem=0x99df78) returned 0x0 [0118.120] LocalAlloc (uFlags=0x0, uBytes=0x22) returned 0x9a7290 [0118.120] _wcslwr_s (in: _String="r:System.Web.dll", _SizeInWords=0x11 | out: _String="r:system.web.dll") returned 0x0 [0118.120] wcstok_s (in: _String="r:system.web.dll", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="r", _Context=0x18fdd4*="system.web.dll") returned="r" [0118.120] LocalFree (hMem=0x9a7290) returned 0x0 [0118.120] LocalAlloc (uFlags=0x0, uBytes=0x1e) returned 0x99f458 [0118.120] LocalAlloc (uFlags=0x0, uBytes=0x1e) returned 0x99f3e0 [0118.120] LocalAlloc (uFlags=0x0, uBytes=0x1e) returned 0x99f408 [0118.120] LocalAlloc (uFlags=0x0, uBytes=0x1e) returned 0x99f430 [0118.120] _wsplitpath_s (in: _FullPath="System.Web.dll", _Drive=0x99f3e0, _DriveCount=0xf, _Dir=0x99f408, _DirCount=0xf, _Filename=0x99f458, _FilenameCount=0xf, _Ext=0x99f430, _ExtCount=0xf | out: _Drive="", _Dir="", _Filename="System.Web", _Ext=".dll") returned 0x0 [0118.120] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x9f98f0 [0118.120] GetFullPathNameW (in: lpFileName="System.Web.dll", nBufferLength=0x104, lpBuffer=0x9f98f0, lpFilePart=0x18fb08 | out: lpBuffer="C:\\Windows\\system32\\System.Web.dll", lpFilePart=0x18fb08*="System.Web.dll") returned 0x22 [0118.120] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\System.Web.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x400, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x18fb70, ftLastAccessTime.dwLowDateTime=0x71d12fc9, ftLastAccessTime.dwHighDateTime=0xd, ftLastWriteTime.dwLowDateTime=0x1, ftLastWriteTime.dwHighDateTime=0x400, nFileSizeHigh=0x18fb80, nFileSizeLow=0x2, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x2d3c\x7680\x9264\x46\x0e")) returned 0xffffffff [0118.120] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x9acda0 [0118.120] LocalAlloc (uFlags=0x0, uBytes=0x7c) returned 0x9f9b08 [0118.121] wcscpy_s (in: _Destination=0x9f9b64, _SizeInWords=0x10, _Source="System.Web.dll" | out: _Destination="System.Web.dll") returned 0x0 [0118.121] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Web.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99e0821d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99e0821d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99f5ee80, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x502000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.dll", cAlternateFileName="")) returned 0x9b6948 [0118.121] LocalFree (hMem=0x9acda0) returned 0x0 [0118.121] FindClose (in: hFindFile=0x9b6948 | out: hFindFile=0x9b6948) returned 1 [0118.121] LocalAlloc (uFlags=0x0, uBytes=0x7a) returned 0x9a7cf0 [0118.121] LocalFree (hMem=0x9f9b08) returned 0x0 [0118.121] LocalFree (hMem=0x9f98f0) returned 0x0 [0118.121] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0118.121] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x384690 [0118.174] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x385518 [0118.181] CoTaskMemAlloc (cb=0x7a) returned 0x9a7d78 [0118.181] wcscpy_s (in: _Destination=0x9a7d78, _SizeInWords=0x3d, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Web.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Web.dll") returned 0x0 [0118.181] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x9acda0 [0118.182] LocalFree (hMem=0x9acda0) returned 0x0 [0118.185] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xa4) returned 0x385740 [0118.197] CoTaskMemFree (pv=0x9a7d78) [0118.197] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x3857f0 [0118.197] LocalFree (hMem=0x9a7cf0) returned 0x0 [0118.197] LocalFree (hMem=0x99f408) returned 0x0 [0118.197] LocalFree (hMem=0x99f3e0) returned 0x0 [0118.197] LocalFree (hMem=0x99f458) returned 0x0 [0118.197] LocalFree (hMem=0x99f430) returned 0x0 [0118.197] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x99df78 [0118.197] _wcslwr_s (in: _String="r:System.Web.Mobile.dll", _SizeInWords=0x18 | out: _String="r:system.web.mobile.dll") returned 0x0 [0118.197] wcstok_s (in: _String="r:system.web.mobile.dll", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="r", _Context=0x18fdd4*="system.web.mobile.dll") returned="r" [0118.197] LocalFree (hMem=0x99df78) returned 0x0 [0118.197] LocalAlloc (uFlags=0x0, uBytes=0x2c) returned 0x99df78 [0118.197] LocalAlloc (uFlags=0x0, uBytes=0x2c) returned 0x99ded0 [0118.197] LocalAlloc (uFlags=0x0, uBytes=0x2c) returned 0x99df08 [0118.197] LocalAlloc (uFlags=0x0, uBytes=0x2c) returned 0x99df40 [0118.197] _wsplitpath_s (in: _FullPath="System.Web.Mobile.dll", _Drive=0x99ded0, _DriveCount=0x16, _Dir=0x99df08, _DirCount=0x16, _Filename=0x99df78, _FilenameCount=0x16, _Ext=0x99df40, _ExtCount=0x16 | out: _Drive="", _Dir="", _Filename="System.Web.Mobile", _Ext=".dll") returned 0x0 [0118.197] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x9f98f0 [0118.197] GetFullPathNameW (in: lpFileName="System.Web.Mobile.dll", nBufferLength=0x104, lpBuffer=0x9f98f0, lpFilePart=0x18fb08 | out: lpBuffer="C:\\Windows\\system32\\System.Web.Mobile.dll", lpFilePart=0x18fb08*="System.Web.Mobile.dll") returned 0x29 [0118.197] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\System.Web.Mobile.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x400, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x18fb70, ftLastAccessTime.dwLowDateTime=0x71d12fc9, ftLastAccessTime.dwHighDateTime=0xd, ftLastWriteTime.dwLowDateTime=0x1, ftLastWriteTime.dwHighDateTime=0x2, nFileSizeHigh=0x3857e8, nFileSizeLow=0x360000, dwReserved0=0x385fe0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x2d3c\x7680\x9264\x46\x15")) returned 0xffffffff [0118.198] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x9acda0 [0118.198] LocalAlloc (uFlags=0x0, uBytes=0x8a) returned 0x9f9b08 [0118.198] wcscpy_s (in: _Destination=0x9f9b64, _SizeInWords=0x17, _Source="System.Web.Mobile.dll" | out: _Destination="System.Web.Mobile.dll") returned 0x0 [0118.198] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Web.Mobile.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fa61870, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8fa61870, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8fa879d0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xcc000, dwReserved0=0x385fe0, dwReserved1=0x0, cFileName="System.Web.Mobile.dll", cAlternateFileName="")) returned 0x9b6948 [0118.198] LocalFree (hMem=0x9acda0) returned 0x0 [0118.198] FindClose (in: hFindFile=0x9b6948 | out: hFindFile=0x9b6948) returned 1 [0118.198] LocalAlloc (uFlags=0x0, uBytes=0x88) returned 0x9a7cf0 [0118.198] LocalFree (hMem=0x9f9b08) returned 0x0 [0118.198] LocalFree (hMem=0x9f98f0) returned 0x0 [0118.198] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0118.198] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x385800 [0118.212] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x386688 [0118.229] CoTaskMemAlloc (cb=0x88) returned 0x9a7d80 [0118.229] wcscpy_s (in: _Destination=0x9a7d80, _SizeInWords=0x44, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Web.Mobile.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Web.Mobile.dll") returned 0x0 [0118.230] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x9acda0 [0118.230] LocalFree (hMem=0x9acda0) returned 0x0 [0118.232] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xa4) returned 0x3868b0 [0118.245] CoTaskMemFree (pv=0x9a7d80) [0118.245] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x386960 [0118.245] LocalFree (hMem=0x9a7cf0) returned 0x0 [0118.245] LocalFree (hMem=0x99df08) returned 0x0 [0118.245] LocalFree (hMem=0x99ded0) returned 0x0 [0118.245] LocalFree (hMem=0x99df78) returned 0x0 [0118.245] LocalFree (hMem=0x99df40) returned 0x0 [0118.245] LocalAlloc (uFlags=0x0, uBytes=0x48) returned 0x99b150 [0118.245] _wcslwr_s (in: _String="r:System.Web.RegularExpressions.dll", _SizeInWords=0x24 | out: _String="r:system.web.regularexpressions.dll") returned 0x0 [0118.245] wcstok_s (in: _String="r:system.web.regularexpressions.dll", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="r", _Context=0x18fdd4*="system.web.regularexpressions.dll") returned="r" [0118.245] LocalFree (hMem=0x99b150) returned 0x0 [0118.245] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x99b150 [0118.245] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x99af70 [0118.245] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x99b0b0 [0118.245] LocalAlloc (uFlags=0x0, uBytes=0x44) returned 0x99b100 [0118.245] _wsplitpath_s (in: _FullPath="System.Web.RegularExpressions.dll", _Drive=0x99af70, _DriveCount=0x22, _Dir=0x99b0b0, _DirCount=0x22, _Filename=0x99b150, _FilenameCount=0x22, _Ext=0x99b100, _ExtCount=0x22 | out: _Drive="", _Dir="", _Filename="System.Web.RegularExpressions", _Ext=".dll") returned 0x0 [0118.245] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x9f98f0 [0118.245] GetFullPathNameW (in: lpFileName="System.Web.RegularExpressions.dll", nBufferLength=0x104, lpBuffer=0x9f98f0, lpFilePart=0x18fb08 | out: lpBuffer="C:\\Windows\\system32\\System.Web.RegularExpressions.dll", lpFilePart=0x18fb08*="System.Web.RegularExpressions.dll") returned 0x35 [0118.245] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\System.Web.RegularExpressions.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x400, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x18fb70, ftLastAccessTime.dwLowDateTime=0x71d12fc9, ftLastAccessTime.dwHighDateTime=0xd, ftLastWriteTime.dwLowDateTime=0x1, ftLastWriteTime.dwHighDateTime=0x2, nFileSizeHigh=0x386958, nFileSizeLow=0x360000, dwReserved0=0x386fe0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x2d3c\x7680\x9264\x46\x21")) returned 0xffffffff [0118.246] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x9acda0 [0118.246] LocalAlloc (uFlags=0x0, uBytes=0xa2) returned 0x9f9b08 [0118.246] wcscpy_s (in: _Destination=0x9f9b64, _SizeInWords=0x23, _Source="System.Web.RegularExpressions.dll" | out: _Destination="System.Web.RegularExpressions.dll") returned 0x0 [0118.246] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Web.RegularExpressions.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x503cefe, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x503cefe, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0xad7422dc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x386fe0, dwReserved1=0x0, cFileName="System.Web.RegularExpressions.dll", cAlternateFileName="")) returned 0x9b6948 [0118.246] LocalFree (hMem=0x9acda0) returned 0x0 [0118.246] FindClose (in: hFindFile=0x9b6948 | out: hFindFile=0x9b6948) returned 1 [0118.246] LocalAlloc (uFlags=0x0, uBytes=0xa0) returned 0x9a7cf0 [0118.246] LocalFree (hMem=0x9f9b08) returned 0x0 [0118.246] LocalFree (hMem=0x9f98f0) returned 0x0 [0118.246] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0118.246] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x386970 [0118.253] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x3877f8 [0118.257] CoTaskMemAlloc (cb=0xa0) returned 0x9cbd40 [0118.257] wcscpy_s (in: _Destination=0x9cbd40, _SizeInWords=0x50, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Web.RegularExpressions.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Web.RegularExpressions.dll") returned 0x0 [0118.258] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x9acda0 [0118.259] LocalFree (hMem=0x9acda0) returned 0x0 [0118.259] VirtualAlloc (lpAddress=0x2bb000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x2bb000 [0118.260] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xa4) returned 0x387a20 [0118.260] CoTaskMemFree (pv=0x9cbd40) [0118.260] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x387ad0 [0118.260] LocalFree (hMem=0x9a7cf0) returned 0x0 [0118.261] LocalFree (hMem=0x99b0b0) returned 0x0 [0118.261] LocalFree (hMem=0x99af70) returned 0x0 [0118.261] LocalFree (hMem=0x99b150) returned 0x0 [0118.261] LocalFree (hMem=0x99b100) returned 0x0 [0118.261] LocalAlloc (uFlags=0x0, uBytes=0x34) returned 0x9b6948 [0118.261] _wcslwr_s (in: _String="r:System.Web.Services.dll", _SizeInWords=0x1a | out: _String="r:system.web.services.dll") returned 0x0 [0118.261] wcstok_s (in: _String="r:system.web.services.dll", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="r", _Context=0x18fdd4*="system.web.services.dll") returned="r" [0118.261] LocalFree (hMem=0x9b6948) returned 0x0 [0118.261] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x99df40 [0118.261] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x99df78 [0118.261] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x99ded0 [0118.261] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x99df08 [0118.261] _wsplitpath_s (in: _FullPath="System.Web.Services.dll", _Drive=0x99df78, _DriveCount=0x18, _Dir=0x99ded0, _DirCount=0x18, _Filename=0x99df40, _FilenameCount=0x18, _Ext=0x99df08, _ExtCount=0x18 | out: _Drive="", _Dir="", _Filename="System.Web.Services", _Ext=".dll") returned 0x0 [0118.261] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x9f98f0 [0118.261] GetFullPathNameW (in: lpFileName="System.Web.Services.dll", nBufferLength=0x104, lpBuffer=0x9f98f0, lpFilePart=0x18fb08 | out: lpBuffer="C:\\Windows\\system32\\System.Web.Services.dll", lpFilePart=0x18fb08*="System.Web.Services.dll") returned 0x2b [0118.261] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\System.Web.Services.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x400, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x18fb70, ftLastAccessTime.dwLowDateTime=0x71d12fc9, ftLastAccessTime.dwHighDateTime=0xd, ftLastWriteTime.dwLowDateTime=0x1, ftLastWriteTime.dwHighDateTime=0x2, nFileSizeHigh=0x387ac8, nFileSizeLow=0x360000, dwReserved0=0x387fe0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x2d3c\x7680\x9264\x46\x17")) returned 0xffffffff [0118.261] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x9acda0 [0118.261] LocalAlloc (uFlags=0x0, uBytes=0x8e) returned 0x9f9b08 [0118.261] wcscpy_s (in: _Destination=0x9f9b64, _SizeInWords=0x19, _Source="System.Web.Services.dll" | out: _Destination="System.Web.Services.dll") returned 0x0 [0118.261] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Web.Services.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8eb0eab4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8eb0eab4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8eb0eab4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xcd000, dwReserved0=0x387fe0, dwReserved1=0x0, cFileName="System.Web.Services.dll", cAlternateFileName="")) returned 0x9b6948 [0118.261] LocalFree (hMem=0x9acda0) returned 0x0 [0118.261] FindClose (in: hFindFile=0x9b6948 | out: hFindFile=0x9b6948) returned 1 [0118.262] LocalAlloc (uFlags=0x0, uBytes=0x8c) returned 0x9a7cf0 [0118.262] LocalFree (hMem=0x9f9b08) returned 0x0 [0118.262] LocalFree (hMem=0x9f98f0) returned 0x0 [0118.262] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0118.262] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x387ae0 [0118.262] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x388968 [0118.267] CoTaskMemAlloc (cb=0x8c) returned 0x9cbd40 [0118.267] wcscpy_s (in: _Destination=0x9cbd40, _SizeInWords=0x46, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Web.Services.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Web.Services.dll") returned 0x0 [0118.268] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x9acda0 [0118.268] LocalFree (hMem=0x9acda0) returned 0x0 [0118.270] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xa4) returned 0x388b90 [0118.273] CoTaskMemFree (pv=0x9cbd40) [0118.273] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x388c40 [0118.273] LocalFree (hMem=0x9a7cf0) returned 0x0 [0118.273] LocalFree (hMem=0x99ded0) returned 0x0 [0118.273] LocalFree (hMem=0x99df78) returned 0x0 [0118.273] LocalFree (hMem=0x99df40) returned 0x0 [0118.273] LocalFree (hMem=0x99df08) returned 0x0 [0118.273] LocalAlloc (uFlags=0x0, uBytes=0x36) returned 0x9b6948 [0118.273] _wcslwr_s (in: _String="r:System.Windows.Forms.Dll", _SizeInWords=0x1b | out: _String="r:system.windows.forms.dll") returned 0x0 [0118.273] wcstok_s (in: _String="r:system.windows.forms.dll", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="r", _Context=0x18fdd4*="system.windows.forms.dll") returned="r" [0118.273] LocalFree (hMem=0x9b6948) returned 0x0 [0118.273] LocalAlloc (uFlags=0x0, uBytes=0x32) returned 0x9b6948 [0118.273] LocalAlloc (uFlags=0x0, uBytes=0x32) returned 0x9b6988 [0118.273] LocalAlloc (uFlags=0x0, uBytes=0x32) returned 0x9b69c8 [0118.273] LocalAlloc (uFlags=0x0, uBytes=0x32) returned 0x9b6908 [0118.273] _wsplitpath_s (in: _FullPath="System.Windows.Forms.Dll", _Drive=0x9b6988, _DriveCount=0x19, _Dir=0x9b69c8, _DirCount=0x19, _Filename=0x9b6948, _FilenameCount=0x19, _Ext=0x9b6908, _ExtCount=0x19 | out: _Drive="", _Dir="", _Filename="System.Windows.Forms", _Ext=".Dll") returned 0x0 [0118.273] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x9f98f0 [0118.273] GetFullPathNameW (in: lpFileName="System.Windows.Forms.Dll", nBufferLength=0x104, lpBuffer=0x9f98f0, lpFilePart=0x18fb08 | out: lpBuffer="C:\\Windows\\system32\\System.Windows.Forms.Dll", lpFilePart=0x18fb08*="System.Windows.Forms.Dll") returned 0x2c [0118.273] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\System.Windows.Forms.Dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x400, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x18fb70, ftLastAccessTime.dwLowDateTime=0x71d12fc9, ftLastAccessTime.dwHighDateTime=0xd, ftLastWriteTime.dwLowDateTime=0x1, ftLastWriteTime.dwHighDateTime=0x2, nFileSizeHigh=0x388c38, nFileSizeLow=0x360000, dwReserved0=0x388fe0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x2d3c\x7680\x9264\x46\x18")) returned 0xffffffff [0118.274] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x9acda0 [0118.274] LocalAlloc (uFlags=0x0, uBytes=0x90) returned 0x9f9b08 [0118.274] wcscpy_s (in: _Destination=0x9f9b64, _SizeInWords=0x1a, _Source="System.Windows.Forms.Dll" | out: _Destination="System.Windows.Forms.Dll") returned 0x0 [0118.274] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Windows.Forms.Dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f9a4db, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x82f9a4db, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8300c8fb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4cb000, dwReserved0=0x388fe0, dwReserved1=0x0, cFileName="System.Windows.Forms.dll", cAlternateFileName="")) returned 0x9b6a08 [0118.274] LocalFree (hMem=0x9acda0) returned 0x0 [0118.274] FindClose (in: hFindFile=0x9b6a08 | out: hFindFile=0x9b6a08) returned 1 [0118.274] LocalAlloc (uFlags=0x0, uBytes=0x8e) returned 0x9a7cf0 [0118.274] LocalFree (hMem=0x9f9b08) returned 0x0 [0118.274] LocalFree (hMem=0x9f98f0) returned 0x0 [0118.274] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0118.274] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x388c50 [0118.281] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x389ad8 [0118.285] CoTaskMemAlloc (cb=0x8e) returned 0x9cbd40 [0118.285] wcscpy_s (in: _Destination=0x9cbd40, _SizeInWords=0x47, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Windows.Forms.Dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.Windows.Forms.Dll") returned 0x0 [0118.285] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x9acda0 [0118.286] LocalFree (hMem=0x9acda0) returned 0x0 [0118.289] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x14) returned 0x389d00 [0118.295] CoTaskMemFree (pv=0x9cbd40) [0118.295] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x389d20 [0118.295] LocalFree (hMem=0x9a7cf0) returned 0x0 [0118.295] LocalFree (hMem=0x9b69c8) returned 0x0 [0118.295] LocalFree (hMem=0x9b6988) returned 0x0 [0118.295] LocalFree (hMem=0x9b6948) returned 0x0 [0118.295] LocalFree (hMem=0x9b6908) returned 0x0 [0118.295] LocalAlloc (uFlags=0x0, uBytes=0x22) returned 0x9a7290 [0118.295] _wcslwr_s (in: _String="r:System.XML.dll", _SizeInWords=0x11 | out: _String="r:system.xml.dll") returned 0x0 [0118.295] wcstok_s (in: _String="r:system.xml.dll", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="r", _Context=0x18fdd4*="system.xml.dll") returned="r" [0118.295] LocalFree (hMem=0x9a7290) returned 0x0 [0118.295] LocalAlloc (uFlags=0x0, uBytes=0x1e) returned 0x99f430 [0118.295] LocalAlloc (uFlags=0x0, uBytes=0x1e) returned 0x99f458 [0118.295] LocalAlloc (uFlags=0x0, uBytes=0x1e) returned 0x99f3e0 [0118.295] LocalAlloc (uFlags=0x0, uBytes=0x1e) returned 0x99f408 [0118.296] _wsplitpath_s (in: _FullPath="System.XML.dll", _Drive=0x99f458, _DriveCount=0xf, _Dir=0x99f3e0, _DirCount=0xf, _Filename=0x99f430, _FilenameCount=0xf, _Ext=0x99f408, _ExtCount=0xf | out: _Drive="", _Dir="", _Filename="System.XML", _Ext=".dll") returned 0x0 [0118.296] LocalAlloc (uFlags=0x0, uBytes=0x20a) returned 0x9f98f0 [0118.296] GetFullPathNameW (in: lpFileName="System.XML.dll", nBufferLength=0x104, lpBuffer=0x9f98f0, lpFilePart=0x18fb08 | out: lpBuffer="C:\\Windows\\system32\\System.XML.dll", lpFilePart=0x18fb08*="System.XML.dll") returned 0x22 [0118.296] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\System.XML.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x400, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x18fb70, ftLastAccessTime.dwLowDateTime=0x71d12fc9, ftLastAccessTime.dwHighDateTime=0xd, ftLastWriteTime.dwLowDateTime=0x1, ftLastWriteTime.dwHighDateTime=0x2, nFileSizeHigh=0x389d18, nFileSizeLow=0x360000, dwReserved0=0x389fe0, dwReserved1=0x0, cFileName="", cAlternateFileName="\x2d3c\x7680\x9264\x46\x0e")) returned 0xffffffff [0118.315] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x9acda0 [0118.315] LocalAlloc (uFlags=0x0, uBytes=0x7c) returned 0x9f9b08 [0118.315] wcscpy_s (in: _Destination=0x9f9b64, _SizeInWords=0x10, _Source="System.XML.dll" | out: _Destination="System.XML.dll") returned 0x0 [0118.315] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.XML.dll", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x832ba1c0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x832ba1c0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x832e0321, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f4000, dwReserved0=0x389fe0, dwReserved1=0x0, cFileName="System.XML.dll", cAlternateFileName="")) returned 0x9b6908 [0118.315] LocalFree (hMem=0x9acda0) returned 0x0 [0118.315] FindClose (in: hFindFile=0x9b6908 | out: hFindFile=0x9b6908) returned 1 [0118.316] LocalAlloc (uFlags=0x0, uBytes=0x7a) returned 0x9a7cf0 [0118.316] LocalFree (hMem=0x9f9b08) returned 0x0 [0118.316] LocalFree (hMem=0x9f98f0) returned 0x0 [0118.316] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0118.316] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe80) returned 0x389d30 [0118.316] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x21c) returned 0x38abb8 [0118.320] CoTaskMemAlloc (cb=0x7a) returned 0x9a7d78 [0118.320] wcscpy_s (in: _Destination=0x9a7d78, _SizeInWords=0x3d, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.XML.dll" | out: _Destination="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\System.XML.dll") returned 0x0 [0118.321] LocalAlloc (uFlags=0x0, uBytes=0x60) returned 0x9acda0 [0118.322] LocalFree (hMem=0x9acda0) returned 0x0 [0118.388] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x14) returned 0x38ade0 [0118.393] CoTaskMemFree (pv=0x9a7d78) [0118.393] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x4) returned 0x38ae00 [0118.394] LocalFree (hMem=0x9a7cf0) returned 0x0 [0118.394] LocalFree (hMem=0x99f3e0) returned 0x0 [0118.394] LocalFree (hMem=0x99f458) returned 0x0 [0118.394] LocalFree (hMem=0x99f430) returned 0x0 [0118.394] LocalFree (hMem=0x99f408) returned 0x0 [0118.394] LocalAlloc (uFlags=0x0, uBytes=0x1e) returned 0x99f408 [0118.394] _wcslwr_s (in: _String="imports:System", _SizeInWords=0xf | out: _String="imports:system") returned 0x0 [0118.394] wcstok_s (in: _String="imports:system", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="imports", _Context=0x18fdd4*="system") returned="imports" [0118.394] LocalFree (hMem=0x99f408) returned 0x0 [0118.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0118.394] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x10) returned 0x38ae10 [0118.394] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0xe) returned 0x38ae28 [0118.394] LocalAlloc (uFlags=0x0, uBytes=0x3c) returned 0x994e80 [0118.394] _wcslwr_s (in: _String="imports:Microsoft.VisualBasic", _SizeInWords=0x1e | out: _String="imports:microsoft.visualbasic") returned 0x0 [0118.394] wcstok_s (in: _String="imports:microsoft.visualbasic", _Delimiter=":+-", _Context=0x18fdd4*=0x0 | out: _String="imports", _Context=0x18fdd4*="microsoft.visualbasic") returned="imports" [0118.394] LocalFree (hMem=0x994e80) returned 0x0 [0118.394] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0118.394] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x10) returned 0x38ae40 [0118.394] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x2c) returned 0x38ae58 [0118.394] FindFirstFileW (in: lpFileName="e", lpFindFileData=0x18f8f0 | out: lpFindFileData=0x18f8f0*(dwFileAttributes=0x980150, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x980150, ftLastAccessTime.dwHighDateTime=0x2000002, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x2000103, nFileSizeHigh=0x5c, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x3, cFileName="", cAlternateFileName="\xfb3c\x18\xb552\x71d5\x37cc\x9d\x01")) returned 0xffffffff [0118.395] LoadStringW (in: hInstance=0x230001, uID=0x7d5, lpBuffer=0x18f0b8, cchBufferMax=512 | out: lpBuffer="file '%s' could not be found") returned 0x1c [0118.395] _vsnwprintf_s (in: _Buffer=0x18d0b8, _BufferCount=0x1000, _MaxCount=0xfff, _Format="file '%s' could not be found", _ArgList=0x18f8c8 | out: _Buffer="file 'e' could not be found") returned 27 [0118.395] _vsnwprintf_s (in: _Buffer=0x18b078, _BufferCount=0x1000, _MaxCount=0xfff, _Format="%s", _ArgList=0x18d088 | out: _Buffer="vbc") returned 3 [0118.395] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0118.395] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="vbc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0118.395] LocalAlloc (uFlags=0x0, uBytes=0x3) returned 0x998fd8 [0118.395] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="vbc", cchWideChar=3, lpMultiByteStr=0x998fd8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vbc", lpUsedDefaultChar=0x0) returned 3 [0118.395] WriteFile (in: hFile=0x7, lpBuffer=0x998fd8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x18b058, lpOverlapped=0x0 | out: lpBuffer=0x998fd8*, lpNumberOfBytesWritten=0x18b058*=0x3, lpOverlapped=0x0) returned 1 [0118.395] LocalFree (hMem=0x998fd8) returned 0x0 [0118.395] _vsnwprintf_s (in: _Buffer=0x18b07c, _BufferCount=0x1000, _MaxCount=0xfff, _Format=" : ", _ArgList=0x18d08c | out: _Buffer=" : ") returned 3 [0118.395] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0118.395] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" : ", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0118.395] LocalAlloc (uFlags=0x0, uBytes=0x3) returned 0x998fd8 [0118.395] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" : ", cchWideChar=3, lpMultiByteStr=0x998fd8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" : ", lpUsedDefaultChar=0x0) returned 3 [0118.396] WriteFile (in: hFile=0x7, lpBuffer=0x998fd8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x18b05c, lpOverlapped=0x0 | out: lpBuffer=0x998fd8*, lpNumberOfBytesWritten=0x18b05c*=0x3, lpOverlapped=0x0) returned 1 [0118.396] LocalFree (hMem=0x998fd8) returned 0x0 [0118.396] LoadStringW (in: hInstance=0x230001, uID=0x7d2, lpBuffer=0x18a87c, cchBufferMax=512 | out: lpBuffer="Command line error") returned 0x12 [0118.396] _vsnwprintf_s (in: _Buffer=0x18b07c, _BufferCount=0x1000, _MaxCount=0xfff, _Format="Command line error", _ArgList=0x18d08c | out: _Buffer="Command line error") returned 18 [0118.396] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0118.396] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Command line error", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0118.396] LocalAlloc (uFlags=0x0, uBytes=0x12) returned 0x9fb048 [0118.396] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Command line error", cchWideChar=18, lpMultiByteStr=0x9fb048, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Command line error", lpUsedDefaultChar=0x0) returned 18 [0118.396] WriteFile (in: hFile=0x7, lpBuffer=0x9fb048*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18a85c, lpOverlapped=0x0 | out: lpBuffer=0x9fb048*, lpNumberOfBytesWritten=0x18a85c*=0x12, lpOverlapped=0x0) returned 1 [0118.396] LocalFree (hMem=0x9fb048) returned 0x0 [0118.396] _vsnwprintf_s (in: _Buffer=0x18b074, _BufferCount=0x1000, _MaxCount=0xfff, _Format=" BC%04d : ", _ArgList=0x18d084 | out: _Buffer=" BC2001 : ") returned 10 [0118.396] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0118.396] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" BC2001 : ", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0118.396] LocalAlloc (uFlags=0x0, uBytes=0xa) returned 0x9fac18 [0118.396] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" BC2001 : ", cchWideChar=10, lpMultiByteStr=0x9fac18, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" BC2001 : .", lpUsedDefaultChar=0x0) returned 10 [0118.396] WriteFile (in: hFile=0x7, lpBuffer=0x9fac18*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18b054, lpOverlapped=0x0 | out: lpBuffer=0x9fac18*, lpNumberOfBytesWritten=0x18b054*=0xa, lpOverlapped=0x0) returned 1 [0118.397] LocalFree (hMem=0x9fac18) returned 0x0 [0118.397] _vsnwprintf_s (in: _Buffer=0x18b078, _BufferCount=0x1000, _MaxCount=0xfff, _Format="%s", _ArgList=0x18d088 | out: _Buffer="file 'e' could not be found") returned 27 [0118.397] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0118.397] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="file 'e' could not be found", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0118.397] LocalAlloc (uFlags=0x0, uBytes=0x1b) returned 0x99f408 [0118.397] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="file 'e' could not be found", cchWideChar=27, lpMultiByteStr=0x99f408, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file 'e' could not be found", lpUsedDefaultChar=0x0) returned 27 [0118.397] WriteFile (in: hFile=0x7, lpBuffer=0x99f408*, nNumberOfBytesToWrite=0x1b, lpNumberOfBytesWritten=0x18b058, lpOverlapped=0x0 | out: lpBuffer=0x99f408*, lpNumberOfBytesWritten=0x18b058*=0x1b, lpOverlapped=0x0) returned 1 [0118.399] LocalFree (hMem=0x99f408) returned 0x0 [0118.399] _vsnwprintf_s (in: _Buffer=0x18b07c, _BufferCount=0x1000, _MaxCount=0xfff, _Format="\n", _ArgList=0x18d08c | out: _Buffer="\n") returned 1 [0118.399] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0118.400] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0118.400] LocalAlloc (uFlags=0x0, uBytes=0x1) returned 0x998fd8 [0118.400] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x998fd8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\n", lpUsedDefaultChar=0x0) returned 1 [0118.400] WriteFile (in: hFile=0x7, lpBuffer=0x998fd8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18b05c, lpOverlapped=0x0 | out: lpBuffer=0x998fd8*, lpNumberOfBytesWritten=0x18b05c*=0x1, lpOverlapped=0x0) returned 1 [0118.400] LocalFree (hMem=0x998fd8) returned 0x0 [0118.400] LoadStringW (in: hInstance=0x230001, uID=0x7db, lpBuffer=0x18f5e8, cchBufferMax=512 | out: lpBuffer="no input sources specified") returned 0x1a [0118.400] _vsnwprintf_s (in: _Buffer=0x18d5e8, _BufferCount=0x1000, _MaxCount=0xfff, _Format="no input sources specified", _ArgList=0x18fdf8 | out: _Buffer="no input sources specified") returned 26 [0118.400] _vsnwprintf_s (in: _Buffer=0x18b5a8, _BufferCount=0x1000, _MaxCount=0xfff, _Format="%s", _ArgList=0x18d5b8 | out: _Buffer="vbc") returned 3 [0118.400] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0118.400] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="vbc", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0118.400] LocalAlloc (uFlags=0x0, uBytes=0x3) returned 0x998fd8 [0118.400] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="vbc", cchWideChar=3, lpMultiByteStr=0x998fd8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vbc", lpUsedDefaultChar=0x0) returned 3 [0118.400] WriteFile (in: hFile=0x7, lpBuffer=0x998fd8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x18b588, lpOverlapped=0x0 | out: lpBuffer=0x998fd8*, lpNumberOfBytesWritten=0x18b588*=0x3, lpOverlapped=0x0) returned 1 [0118.400] LocalFree (hMem=0x998fd8) returned 0x0 [0118.401] _vsnwprintf_s (in: _Buffer=0x18b5ac, _BufferCount=0x1000, _MaxCount=0xfff, _Format=" : ", _ArgList=0x18d5bc | out: _Buffer=" : ") returned 3 [0118.401] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0118.401] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" : ", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0118.401] LocalAlloc (uFlags=0x0, uBytes=0x3) returned 0x998fd8 [0118.401] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" : ", cchWideChar=3, lpMultiByteStr=0x998fd8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" : ", lpUsedDefaultChar=0x0) returned 3 [0118.401] WriteFile (in: hFile=0x7, lpBuffer=0x998fd8*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x18b58c, lpOverlapped=0x0 | out: lpBuffer=0x998fd8*, lpNumberOfBytesWritten=0x18b58c*=0x3, lpOverlapped=0x0) returned 1 [0118.401] LocalFree (hMem=0x998fd8) returned 0x0 [0118.401] LoadStringW (in: hInstance=0x230001, uID=0x7d2, lpBuffer=0x18adac, cchBufferMax=512 | out: lpBuffer="Command line error") returned 0x12 [0118.401] _vsnwprintf_s (in: _Buffer=0x18b5ac, _BufferCount=0x1000, _MaxCount=0xfff, _Format="Command line error", _ArgList=0x18d5bc | out: _Buffer="Command line error") returned 18 [0118.401] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0118.401] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Command line error", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0118.401] LocalAlloc (uFlags=0x0, uBytes=0x12) returned 0x9fb048 [0118.401] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Command line error", cchWideChar=18, lpMultiByteStr=0x9fb048, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Command line error", lpUsedDefaultChar=0x0) returned 18 [0118.401] WriteFile (in: hFile=0x7, lpBuffer=0x9fb048*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x18ad8c, lpOverlapped=0x0 | out: lpBuffer=0x9fb048*, lpNumberOfBytesWritten=0x18ad8c*=0x12, lpOverlapped=0x0) returned 1 [0118.401] LocalFree (hMem=0x9fb048) returned 0x0 [0118.401] _vsnwprintf_s (in: _Buffer=0x18b5a4, _BufferCount=0x1000, _MaxCount=0xfff, _Format=" BC%04d : ", _ArgList=0x18d5b4 | out: _Buffer=" BC2008 : ") returned 10 [0118.401] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0118.401] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" BC2008 : ", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0118.402] LocalAlloc (uFlags=0x0, uBytes=0xa) returned 0x9fac18 [0118.402] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" BC2008 : ", cchWideChar=10, lpMultiByteStr=0x9fac18, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" BC2008 : .", lpUsedDefaultChar=0x0) returned 10 [0118.402] WriteFile (in: hFile=0x7, lpBuffer=0x9fac18*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x18b584, lpOverlapped=0x0 | out: lpBuffer=0x9fac18*, lpNumberOfBytesWritten=0x18b584*=0xa, lpOverlapped=0x0) returned 1 [0118.402] LocalFree (hMem=0x9fac18) returned 0x0 [0118.402] _vsnwprintf_s (in: _Buffer=0x18b5a8, _BufferCount=0x1000, _MaxCount=0xfff, _Format="%s", _ArgList=0x18d5b8 | out: _Buffer="no input sources specified") returned 26 [0118.402] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0118.402] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="no input sources specified", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0118.402] LocalAlloc (uFlags=0x0, uBytes=0x1a) returned 0x99f408 [0118.402] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="no input sources specified", cchWideChar=26, lpMultiByteStr=0x99f408, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="no input sources specifiedd", lpUsedDefaultChar=0x0) returned 26 [0118.402] WriteFile (in: hFile=0x7, lpBuffer=0x99f408*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x18b588, lpOverlapped=0x0 | out: lpBuffer=0x99f408*, lpNumberOfBytesWritten=0x18b588*=0x1a, lpOverlapped=0x0) returned 1 [0118.402] LocalFree (hMem=0x99f408) returned 0x0 [0118.402] _vsnwprintf_s (in: _Buffer=0x18b5ac, _BufferCount=0x1000, _MaxCount=0xfff, _Format="\n", _ArgList=0x18d5bc | out: _Buffer="\n") returned 1 [0118.402] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0118.402] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0118.402] LocalAlloc (uFlags=0x0, uBytes=0x1) returned 0x998fd8 [0118.402] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x998fd8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\n", lpUsedDefaultChar=0x0) returned 1 [0118.402] WriteFile (in: hFile=0x7, lpBuffer=0x998fd8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x18b58c, lpOverlapped=0x0 | out: lpBuffer=0x998fd8*, lpNumberOfBytesWritten=0x18b58c*=0x1, lpOverlapped=0x0) returned 1 [0118.403] LocalFree (hMem=0x998fd8) returned 0x0 [0118.403] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0118.403] CoTaskMemFree (pv=0x0) [0118.405] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x36e710 | out: hHeap=0x360000) returned 1 [0118.405] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x36d870 | out: hHeap=0x360000) returned 1 [0118.405] CoTaskMemFree (pv=0x0) [0118.406] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x36f898 | out: hHeap=0x360000) returned 1 [0118.406] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x36fb70 | out: hHeap=0x360000) returned 1 [0118.406] CoTaskMemFree (pv=0x0) [0118.409] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x370a08 | out: hHeap=0x360000) returned 1 [0118.409] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x36e9e8 | out: hHeap=0x360000) returned 1 [0118.409] CoTaskMemFree (pv=0x0) [0118.411] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x371bb0 | out: hHeap=0x360000) returned 1 [0118.411] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x36e9f8 | out: hHeap=0x360000) returned 1 [0118.411] CoTaskMemFree (pv=0x0) [0118.414] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x372d10 | out: hHeap=0x360000) returned 1 [0118.414] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x372f58 | out: hHeap=0x360000) returned 1 [0118.414] CoTaskMemFree (pv=0x0) [0118.469] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x373df0 | out: hHeap=0x360000) returned 1 [0118.469] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x374038 | out: hHeap=0x360000) returned 1 [0118.469] CoTaskMemFree (pv=0x0) [0118.472] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x374ed0 | out: hHeap=0x360000) returned 1 [0118.472] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x370ce0 | out: hHeap=0x360000) returned 1 [0118.472] CoTaskMemFree (pv=0x0) [0118.475] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x376028 | out: hHeap=0x360000) returned 1 [0118.475] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x370cf0 | out: hHeap=0x360000) returned 1 [0118.475] CoTaskMemFree (pv=0x0) [0118.478] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x377188 | out: hHeap=0x360000) returned 1 [0118.478] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x370d00 | out: hHeap=0x360000) returned 1 [0118.478] CoTaskMemFree (pv=0x0) [0118.480] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x3782e8 | out: hHeap=0x360000) returned 1 [0118.480] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x370d10 | out: hHeap=0x360000) returned 1 [0118.480] CoTaskMemFree (pv=0x0) [0118.483] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x379448 | out: hHeap=0x360000) returned 1 [0118.483] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x379690 | out: hHeap=0x360000) returned 1 [0118.483] CoTaskMemFree (pv=0x0) [0118.485] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37a528 | out: hHeap=0x360000) returned 1 [0118.485] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37a800 | out: hHeap=0x360000) returned 1 [0118.485] CoTaskMemFree (pv=0x0) [0118.488] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37b698 | out: hHeap=0x360000) returned 1 [0118.488] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37b970 | out: hHeap=0x360000) returned 1 [0118.488] CoTaskMemFree (pv=0x0) [0118.490] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37c808 | out: hHeap=0x360000) returned 1 [0118.491] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37ca30 | out: hHeap=0x360000) returned 1 [0118.491] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37cd08 | out: hHeap=0x360000) returned 1 [0118.491] CoTaskMemFree (pv=0x0) [0118.493] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37dba0 | out: hHeap=0x360000) returned 1 [0118.493] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37df80 | out: hHeap=0x360000) returned 1 [0118.493] CoTaskMemFree (pv=0x0) [0118.505] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37ee18 | out: hHeap=0x360000) returned 1 [0118.505] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x375118 | out: hHeap=0x360000) returned 1 [0118.506] CoTaskMemFree (pv=0x0) [0118.508] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37ff78 | out: hHeap=0x360000) returned 1 [0118.508] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x375148 | out: hHeap=0x360000) returned 1 [0118.509] CoTaskMemFree (pv=0x0) [0118.510] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x381028 | out: hHeap=0x360000) returned 1 [0118.511] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x375158 | out: hHeap=0x360000) returned 1 [0118.519] CoTaskMemFree (pv=0x0) [0118.521] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x382188 | out: hHeap=0x360000) returned 1 [0118.521] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x375168 | out: hHeap=0x360000) returned 1 [0118.522] CoTaskMemFree (pv=0x0) [0118.524] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x3832e8 | out: hHeap=0x360000) returned 1 [0118.524] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x375178 | out: hHeap=0x360000) returned 1 [0118.524] CoTaskMemFree (pv=0x0) [0118.526] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x384448 | out: hHeap=0x360000) returned 1 [0118.526] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x375188 | out: hHeap=0x360000) returned 1 [0118.526] CoTaskMemFree (pv=0x0) [0118.529] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x385518 | out: hHeap=0x360000) returned 1 [0118.529] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x3857f0 | out: hHeap=0x360000) returned 1 [0118.529] CoTaskMemFree (pv=0x0) [0118.533] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x386688 | out: hHeap=0x360000) returned 1 [0118.533] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x386960 | out: hHeap=0x360000) returned 1 [0118.533] CoTaskMemFree (pv=0x0) [0118.534] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x3877f8 | out: hHeap=0x360000) returned 1 [0118.534] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x387ad0 | out: hHeap=0x360000) returned 1 [0118.534] CoTaskMemFree (pv=0x0) [0118.537] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x388968 | out: hHeap=0x360000) returned 1 [0118.537] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x388c40 | out: hHeap=0x360000) returned 1 [0118.537] CoTaskMemFree (pv=0x0) [0118.541] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x389ad8 | out: hHeap=0x360000) returned 1 [0118.541] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x389d20 | out: hHeap=0x360000) returned 1 [0118.541] CoTaskMemFree (pv=0x0) [0118.543] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x38abb8 | out: hHeap=0x360000) returned 1 [0118.543] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x38ae00 | out: hHeap=0x360000) returned 1 [0118.543] CoTaskMemFree (pv=0x0) [0118.543] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x38ae58 | out: hHeap=0x360000) returned 1 [0118.543] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x38ae40 | out: hHeap=0x360000) returned 1 [0118.543] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x38ae28 | out: hHeap=0x360000) returned 1 [0118.543] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x38ae10 | out: hHeap=0x360000) returned 1 [0118.543] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x37de78 | out: hHeap=0x360000) returned 1 [0118.543] CoTaskMemFree (pv=0x0) [0118.546] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x363698 | out: hHeap=0x360000) returned 1 [0118.546] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x36d860 | out: hHeap=0x360000) returned 1 [0118.547] CoTaskMemFree (pv=0x0) [0118.549] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x364790 | out: hHeap=0x360000) returned 1 [0118.549] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x36d850 | out: hHeap=0x360000) returned 1 [0118.550] ??3@YAXPAX@Z () returned 0x1 [0118.550] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x364ba0 | out: hHeap=0x360000) returned 1 [0118.550] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x364a68 | out: hHeap=0x360000) returned 1 [0118.550] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x36c9a8 | out: hHeap=0x360000) returned 1 [0118.550] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x36c9b8 | out: hHeap=0x360000) returned 1 [0118.551] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x3625d8 | out: hHeap=0x360000) returned 1 [0118.551] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x360578 | out: hHeap=0x360000) returned 1 [0118.551] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x361580 | out: hHeap=0x360000) returned 1 [0118.551] CoTaskMemFree (pv=0x99bf58) [0118.551] CoTaskMemFree (pv=0x998fa8) [0118.552] VirtualFree (lpAddress=0x260000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.552] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x362588 | out: hHeap=0x360000) returned 1 [0118.552] VirtualFree (lpAddress=0x2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.552] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x3625b0 | out: hHeap=0x360000) returned 1 [0118.552] VirtualFree (lpAddress=0x2d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.552] HeapFree (in: hHeap=0x360000, dwFlags=0x0, lpMem=0x3638c0 | out: hHeap=0x360000) returned 1 [0118.552] CoTaskMemFree (pv=0x998fc8) [0118.552] HeapDestroy (hHeap=0x360000) returned 1 [0118.553] CoTaskMemFree (pv=0x9a3340) [0118.553] CoUninitialize () [0118.554] LocalFree (hMem=0x996da8) returned 0x0 [0118.554] LocalFree (hMem=0x996d98) returned 0x0 [0118.554] LocalFree (hMem=0x996e40) returned 0x0 [0118.554] LocalFree (hMem=0x998b88) returned 0x0 [0118.554] LocalFree (hMem=0x998b78) returned 0x0 [0118.554] LocalFree (hMem=0x998bd0) returned 0x0 [0118.554] LocalFree (hMem=0x998bc0) returned 0x0 [0118.554] LocalFree (hMem=0x998c18) returned 0x0 [0118.554] LocalFree (hMem=0x998c08) returned 0x0 [0118.554] LocalFree (hMem=0x998c68) returned 0x0 [0118.554] LocalFree (hMem=0x998c58) returned 0x0 [0118.554] LocalFree (hMem=0x998cc8) returned 0x0 [0118.554] LocalFree (hMem=0x998cb8) returned 0x0 [0118.554] LocalFree (hMem=0x994ad8) returned 0x0 [0118.554] LocalFree (hMem=0x998cf8) returned 0x0 [0118.554] LocalFree (hMem=0x998d18) returned 0x0 [0118.554] LocalFree (hMem=0x998d08) returned 0x0 [0118.554] LocalFree (hMem=0x998d68) returned 0x0 [0118.554] LocalFree (hMem=0x998d58) returned 0x0 [0118.554] LocalFree (hMem=0x998db8) returned 0x0 [0118.554] LocalFree (hMem=0x998da8) returned 0x0 [0118.554] LocalFree (hMem=0x994b20) returned 0x0 [0118.554] LocalFree (hMem=0x998e08) returned 0x0 [0118.554] LocalFree (hMem=0x996348) returned 0x0 [0118.554] LocalFree (hMem=0x998e18) returned 0x0 [0118.554] LocalFree (hMem=0x994b68) returned 0x0 [0118.554] LocalFree (hMem=0x998e28) returned 0x0 [0118.554] LocalFree (hMem=0x9991f0) returned 0x0 [0118.554] LocalFree (hMem=0x998e38) returned 0x0 [0118.554] LocalFree (hMem=0x999228) returned 0x0 [0118.554] LocalFree (hMem=0x998e48) returned 0x0 [0118.554] LocalFree (hMem=0x999278) returned 0x0 [0118.554] LocalFree (hMem=0x998e58) returned 0x0 [0118.555] LocalFree (hMem=0x9992b8) returned 0x0 [0118.555] LocalFree (hMem=0x998e68) returned 0x0 [0118.555] LocalFree (hMem=0x994bb0) returned 0x0 [0118.555] LocalFree (hMem=0x998e78) returned 0x0 [0118.555] LocalFree (hMem=0x9992f0) returned 0x0 [0118.555] LocalFree (hMem=0x998e88) returned 0x0 [0118.555] LocalFree (hMem=0x999360) returned 0x0 [0118.555] LocalFree (hMem=0x998e98) returned 0x0 [0118.555] LocalFree (hMem=0x994bf8) returned 0x0 [0118.555] LocalFree (hMem=0x998ea8) returned 0x0 [0118.555] LocalFree (hMem=0x999398) returned 0x0 [0118.555] LocalFree (hMem=0x998eb8) returned 0x0 [0118.555] LocalFree (hMem=0x9993d8) returned 0x0 [0118.555] LocalFree (hMem=0x998ec8) returned 0x0 [0118.555] LocalFree (hMem=0x999408) returned 0x0 [0118.555] LocalFree (hMem=0x998ed8) returned 0x0 [0118.555] LocalFree (hMem=0x999448) returned 0x0 [0118.555] LocalFree (hMem=0x998ee8) returned 0x0 [0118.555] LocalFree (hMem=0x9994a0) returned 0x0 [0118.555] LocalFree (hMem=0x998ef8) returned 0x0 [0118.555] LocalFree (hMem=0x9994e0) returned 0x0 [0118.555] LocalFree (hMem=0x998f08) returned 0x0 [0118.555] LocalFree (hMem=0x999520) returned 0x0 [0118.555] LocalFree (hMem=0x998f18) returned 0x0 [0118.555] LocalFree (hMem=0x996370) returned 0x0 [0118.555] LocalFree (hMem=0x998f28) returned 0x0 [0118.555] LocalFree (hMem=0x994c40) returned 0x0 [0118.555] LocalFree (hMem=0x998f38) returned 0x0 [0118.555] LocalFree (hMem=0x996e30) returned 0x0 [0118.555] LocalFree (hMem=0x996e20) returned 0x0 [0118.555] LocalFree (hMem=0x996e50) returned 0x0 [0118.555] LocalFree (hMem=0x98f4a0) returned 0x0 [0118.555] exit (_Code=1)