# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Jun 3 2020 08:38:37 # Log Creation Date: 19.08.2020 13:52:27.322 Process: id = "1" image_name = "cusersnextadminappdatalocalfast.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersnextadminappdatalocalfast.exe" page_root = "0x4ba7a000" os_pid = "0x3a4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x454" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cusersnextadminappdatalocalfast.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x9f4 [0038.117] GetProcessHeap () returned 0x350000 [0038.117] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x30) returned 0x361820 [0038.117] GetProcessHeap () returned 0x350000 [0038.117] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x3a20) returned 0x3661f0 [0038.123] GetProcessHeap () returned 0x350000 [0038.123] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x300) returned 0x369c18 [0038.124] GetProcessHeap () returned 0x350000 [0038.124] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x361648 [0038.124] GetTickCount () returned 0x1144895 [0038.124] GetProcessHeap () returned 0x350000 [0038.124] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20) returned 0x363b08 [0038.124] GetProcessHeap () returned 0x350000 [0038.124] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20a) returned 0x369f20 [0038.124] GetProcessHeap () returned 0x350000 [0038.124] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20a) returned 0x36a138 [0038.124] GetProcessHeap () returned 0x350000 [0038.124] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20a) returned 0x36a350 [0038.124] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x36a350, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cusersnextadminappdatalocalfast.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersnextadminappdatalocalfast.exe")) returned 0x49 [0038.124] GetProcessHeap () returned 0x350000 [0038.124] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a350 | out: hHeap=0x350000) returned 1 [0038.124] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tlup.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tlup.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0038.125] GetProcessHeap () returned 0x350000 [0038.125] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x369f20 | out: hHeap=0x350000) returned 1 [0038.125] GetProcessHeap () returned 0x350000 [0038.125] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a138 | out: hHeap=0x350000) returned 1 [0038.125] GetProcessHeap () returned 0x350000 [0038.125] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x363b08 | out: hHeap=0x350000) returned 1 [0038.125] GetVersion () returned 0x1db10106 [0038.125] GetCurrentProcess () returned 0xffffffff [0038.125] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x2ffa0c | out: TokenHandle=0x2ffa0c*=0xa0) returned 1 [0038.125] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x14, TokenInformation=0x2ffa04, TokenInformationLength=0x4, ReturnLength=0x2ffa08 | out: TokenInformation=0x2ffa04, ReturnLength=0x2ffa08) returned 1 [0038.125] CloseHandle (hObject=0xa0) returned 1 [0038.125] GetProcessHeap () returned 0x350000 [0038.125] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20) returned 0x363b08 [0038.125] GetProcessHeap () returned 0x350000 [0038.125] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20a) returned 0x369f20 [0038.125] GetProcessHeap () returned 0x350000 [0038.125] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20a) returned 0x36a138 [0038.125] GetProcessHeap () returned 0x350000 [0038.125] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x369f20 | out: hHeap=0x350000) returned 1 [0038.125] GetProcessHeap () returned 0x350000 [0038.125] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a138 | out: hHeap=0x350000) returned 1 [0038.125] GetProcessHeap () returned 0x350000 [0038.125] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20) returned 0x363b58 [0038.125] GetProcessHeap () returned 0x350000 [0038.125] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1e) returned 0x363b80 [0038.125] GetProcessHeap () returned 0x350000 [0038.125] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x1e) returned 0x363ba8 [0038.125] GetProcessHeap () returned 0x350000 [0038.125] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x369f20 [0038.125] GetProcessHeap () returned 0x350000 [0038.126] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x369f20 | out: hHeap=0x350000) returned 1 [0038.126] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x363b80, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0038.126] GetProcessHeap () returned 0x350000 [0038.126] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x363ba8 | out: hHeap=0x350000) returned 1 [0038.126] GetProcessHeap () returned 0x350000 [0038.126] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x363b58 | out: hHeap=0x350000) returned 1 [0038.126] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2ff9c4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2ff9c4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0038.126] GetProcessHeap () returned 0x350000 [0038.126] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x363b80 | out: hHeap=0x350000) returned 1 [0038.126] GetProcessHeap () returned 0x350000 [0038.126] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x30) returned 0x369f20 [0038.126] GetProcessHeap () returned 0x350000 [0038.126] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x26) returned 0x369f58 [0038.126] GetProcessHeap () returned 0x350000 [0038.126] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x369f58, Size=0x4a) returned 0x369f58 [0038.126] GetProcessHeap () returned 0x350000 [0038.126] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x369f20 | out: hHeap=0x350000) returned 1 [0038.126] GetProcessHeap () returned 0x350000 [0038.126] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x369f58 | out: hHeap=0x350000) returned 1 [0038.126] GetProcessHeap () returned 0x350000 [0038.127] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x1c) returned 0x363b80 [0038.127] GetProcessHeap () returned 0x350000 [0038.127] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x1c) returned 0x363ba8 [0038.127] GetProcessHeap () returned 0x350000 [0038.127] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20) returned 0x369f38 [0038.127] GetProcessHeap () returned 0x350000 [0038.127] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1e) returned 0x369f60 [0038.127] GetProcessHeap () returned 0x350000 [0038.127] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x1e) returned 0x369f88 [0038.127] GetProcessHeap () returned 0x350000 [0038.127] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x36a720 [0038.127] GetProcessHeap () returned 0x350000 [0038.127] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a720 | out: hHeap=0x350000) returned 1 [0038.127] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x369f60, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0038.127] GetProcessHeap () returned 0x350000 [0038.127] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x369f88 | out: hHeap=0x350000) returned 1 [0038.127] GetProcessHeap () returned 0x350000 [0038.127] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x369f38 | out: hHeap=0x350000) returned 1 [0038.127] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2ff9ac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2ff9ac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0038.127] GetProcessHeap () returned 0x350000 [0038.127] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x369f60 | out: hHeap=0x350000) returned 1 [0038.127] GetProcessHeap () returned 0x350000 [0038.127] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x40) returned 0x363ee0 [0038.128] GetProcessHeap () returned 0x350000 [0038.128] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x3a) returned 0x363f28 [0038.128] GetProcessHeap () returned 0x350000 [0038.128] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x363f28, Size=0x72) returned 0x35f870 [0038.128] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0038.128] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0xa0 [0038.128] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0x0) returned 0x0 [0038.128] GetProcessHeap () returned 0x350000 [0038.128] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x363ee0 | out: hHeap=0x350000) returned 1 [0038.128] GetProcessHeap () returned 0x350000 [0038.128] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x35f870 | out: hHeap=0x350000) returned 1 [0038.128] GetProcessHeap () returned 0x350000 [0038.128] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20) returned 0x369f38 [0038.128] GetProcessHeap () returned 0x350000 [0038.128] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1e) returned 0x369f60 [0038.128] GetProcessHeap () returned 0x350000 [0038.128] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x1e) returned 0x369f88 [0038.128] GetProcessHeap () returned 0x350000 [0038.128] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x36a720 [0038.128] GetProcessHeap () returned 0x350000 [0038.128] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a720 | out: hHeap=0x350000) returned 1 [0038.128] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x369f60, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0038.128] GetProcessHeap () returned 0x350000 [0038.128] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x369f88 | out: hHeap=0x350000) returned 1 [0038.129] GetProcessHeap () returned 0x350000 [0038.129] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x369f38 | out: hHeap=0x350000) returned 1 [0038.129] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2ff994, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2ff994*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0038.129] GetProcessHeap () returned 0x350000 [0038.129] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x369f60 | out: hHeap=0x350000) returned 1 [0038.129] GetProcessHeap () returned 0x350000 [0038.129] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x40) returned 0x363ee0 [0038.129] GetProcessHeap () returned 0x350000 [0038.129] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x3a) returned 0x363f28 [0038.129] GetProcessHeap () returned 0x350000 [0038.129] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x363f28, Size=0x72) returned 0x35f870 [0038.129] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0038.129] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0xa4 [0038.129] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x0) returned 0x0 [0038.129] GetProcessHeap () returned 0x350000 [0038.129] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x363ee0 | out: hHeap=0x350000) returned 1 [0038.129] GetProcessHeap () returned 0x350000 [0038.129] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x35f870 | out: hHeap=0x350000) returned 1 [0038.129] ReleaseMutex (hMutex=0xa4) returned 1 [0038.129] CloseHandle (hObject=0xa4) returned 1 [0038.129] GetProcessHeap () returned 0x350000 [0038.129] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x30) returned 0x36a720 [0038.130] GetProcessHeap () returned 0x350000 [0038.130] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20a) returned 0x36a758 [0038.130] GetVersion () returned 0x1db10106 [0038.130] GetProcessHeap () returned 0x350000 [0038.130] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x50) returned 0x36a970 [0038.130] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0038.130] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0038.130] Wow64DisableWow64FsRedirection (in: OldValue=0x2ff9e8 | out: OldValue=0x2ff9e8*=0x0) returned 1 [0038.130] GetProcessHeap () returned 0x350000 [0038.130] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a970 | out: hHeap=0x350000) returned 1 [0038.130] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x77710000 [0038.130] GetProcAddress (hModule=0x77710000, lpProcName="CreateProcessWithTokenW") returned 0x7775531f [0038.130] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x36a758, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cusersnextadminappdatalocalfast.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersnextadminappdatalocalfast.exe")) returned 0x49 [0038.130] GetShellWindow () returned 0x100f2 [0038.131] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0x2ff9f4 | out: lpdwProcessId=0x2ff9f4) returned 0x458 [0038.131] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x454) returned 0xa4 [0038.131] OpenProcessToken (in: ProcessHandle=0xa4, DesiredAccess=0x2000000, TokenHandle=0x2ffa04 | out: TokenHandle=0x2ffa04*=0xa8) returned 1 [0038.131] DuplicateTokenEx (in: hExistingToken=0xa8, dwDesiredAccess=0x2000000, lpTokenAttributes=0x2ff9cc, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x2ffa08 | out: phNewToken=0x2ffa08*=0xac) returned 1 [0038.131] CreateProcessWithTokenW (in: hToken=0xac, dwLogonFlags=0x0, lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cusersnextadminappdatalocalfast.exe", lpCommandLine=0x0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x2ff980*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2ff9d8 | out: lpCommandLine=0x0, lpProcessInformation=0x2ff9d8*(hProcess=0xf8, hThread=0xfc, dwProcessId=0x5e0, dwThreadId=0x360)) returned 1 [0038.277] GetProcessHeap () returned 0x350000 [0038.277] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x50) returned 0x36f6d8 [0038.278] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0038.278] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76d5d668 [0038.278] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0038.278] GetProcessHeap () returned 0x350000 [0038.278] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36f6d8 | out: hHeap=0x350000) returned 1 [0038.278] CloseHandle (hObject=0xa4) returned 1 [0038.278] CloseHandle (hObject=0xf8) returned 1 [0038.278] CloseHandle (hObject=0xfc) returned 1 [0038.278] CloseHandle (hObject=0xa8) returned 1 [0038.278] CloseHandle (hObject=0xac) returned 1 [0038.278] GetProcessHeap () returned 0x350000 [0038.278] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a758 | out: hHeap=0x350000) returned 1 [0038.278] GetProcessHeap () returned 0x350000 [0038.278] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a720 | out: hHeap=0x350000) returned 1 [0038.278] Sleep (dwMilliseconds=0x1388) [0045.171] GetProcessHeap () returned 0x350000 [0045.171] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0xd0) returned 0x36e950 [0045.171] GetProcessHeap () returned 0x350000 [0045.171] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0xc3) returned 0x36ea28 [0045.171] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1264a72, lpParameter=0x36ea28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac [0045.173] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x0) returned 0x102 [0045.173] CloseHandle (hObject=0xac) returned 1 [0045.173] GetProcessHeap () returned 0x350000 [0045.173] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e950 | out: hHeap=0x350000) returned 1 [0045.173] GetProcessHeap () returned 0x350000 [0045.173] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x60) returned 0x36b4f8 [0045.173] GetProcessHeap () returned 0x350000 [0045.173] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x5c) returned 0x36e0a0 [0045.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1264a72, lpParameter=0x36e0a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac [0045.174] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x0) returned 0x102 [0045.174] CloseHandle (hObject=0xac) returned 1 [0045.174] GetProcessHeap () returned 0x350000 [0045.174] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b4f8 | out: hHeap=0x350000) returned 1 [0045.174] GetProcessHeap () returned 0x350000 [0045.174] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20) returned 0x36a258 [0045.174] GetProcessHeap () returned 0x350000 [0045.174] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1e) returned 0x36a3e8 [0045.174] GetProcessHeap () returned 0x350000 [0045.175] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x1e) returned 0x36a2d0 [0045.175] GetProcessHeap () returned 0x350000 [0045.175] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x36b4f8 [0045.175] GetProcessHeap () returned 0x350000 [0045.175] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b4f8 | out: hHeap=0x350000) returned 1 [0045.175] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x36a3e8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0045.175] GetProcessHeap () returned 0x350000 [0045.175] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a2d0 | out: hHeap=0x350000) returned 1 [0045.175] GetProcessHeap () returned 0x350000 [0045.175] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a258 | out: hHeap=0x350000) returned 1 [0045.175] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2ff9cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2ff9cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0045.175] GetProcessHeap () returned 0x350000 [0045.175] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a3e8 | out: hHeap=0x350000) returned 1 [0045.175] GetProcessHeap () returned 0x350000 [0045.175] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x60) returned 0x36b4f8 [0045.175] GetProcessHeap () returned 0x350000 [0045.175] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20) returned 0x36a3e8 [0045.175] GetProcessHeap () returned 0x350000 [0045.175] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1e) returned 0x36a258 [0045.175] GetProcessHeap () returned 0x350000 [0045.175] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x1e) returned 0x36a2d0 [0045.176] GetProcessHeap () returned 0x350000 [0045.176] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x36e950 [0045.176] GetProcessHeap () returned 0x350000 [0045.176] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e950 | out: hHeap=0x350000) returned 1 [0045.176] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x36a258, nSize=0xf | out: lpDst="") returned 0x2c [0045.176] GetProcessHeap () returned 0x350000 [0045.176] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a2d0 | out: hHeap=0x350000) returned 1 [0045.176] GetProcessHeap () returned 0x350000 [0045.176] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x36a258, Size=0x3a) returned 0x364048 [0045.176] GetProcessHeap () returned 0x350000 [0045.176] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x3a) returned 0x364090 [0045.176] GetProcessHeap () returned 0x350000 [0045.176] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x36e950 [0045.176] GetProcessHeap () returned 0x350000 [0045.176] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e950 | out: hHeap=0x350000) returned 1 [0045.176] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x364048, nSize=0x1d | out: lpDst="") returned 0x2c [0045.176] GetProcessHeap () returned 0x350000 [0045.176] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x364090 | out: hHeap=0x350000) returned 1 [0045.176] GetProcessHeap () returned 0x350000 [0045.176] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x364048, Size=0x72) returned 0x35f870 [0045.176] GetProcessHeap () returned 0x350000 [0045.176] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x72) returned 0x35f8f0 [0045.176] GetProcessHeap () returned 0x350000 [0045.176] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x36e950 [0045.176] GetProcessHeap () returned 0x350000 [0045.176] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e950 | out: hHeap=0x350000) returned 1 [0045.176] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x35f870, nSize=0x39 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x2c [0045.176] GetProcessHeap () returned 0x350000 [0045.176] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x35f8f0 | out: hHeap=0x350000) returned 1 [0045.176] GetProcessHeap () returned 0x350000 [0045.176] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a3e8 | out: hHeap=0x350000) returned 1 [0045.177] GetProcessHeap () returned 0x350000 [0045.177] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x40) returned 0x364048 [0045.177] GetProcessHeap () returned 0x350000 [0045.177] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x3e) returned 0x364090 [0045.177] GetProcessHeap () returned 0x350000 [0045.177] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x3e) returned 0x3640d8 [0045.177] GetProcessHeap () returned 0x350000 [0045.177] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x36e950 [0045.177] GetProcessHeap () returned 0x350000 [0045.177] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x10) returned 0x361780 [0045.177] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x2ff8ec | out: phkResult=0x2ff8ec*=0xa8) returned 0x0 [0045.178] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x2ff8e8, lpData=0x3640d8, lpcbData=0x2ff8f0*=0x3e | out: lpType=0x2ff8e8*=0x2, lpData=0x3640d8*=0x5c, lpcbData=0x2ff8f0*=0x98) returned 0xea [0045.178] RegCloseKey (hKey=0xa8) returned 0x0 [0045.178] GetProcessHeap () returned 0x350000 [0045.178] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x361780 | out: hHeap=0x350000) returned 1 [0045.178] GetProcessHeap () returned 0x350000 [0045.178] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e950 | out: hHeap=0x350000) returned 1 [0045.178] GetProcessHeap () returned 0x350000 [0045.178] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3640d8 | out: hHeap=0x350000) returned 1 [0045.178] GetProcessHeap () returned 0x350000 [0045.178] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x364090, Size=0x7a) returned 0x36e950 [0045.178] GetProcessHeap () returned 0x350000 [0045.178] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x7a) returned 0x36b6e8 [0045.178] GetProcessHeap () returned 0x350000 [0045.178] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x36b770 [0045.178] GetProcessHeap () returned 0x350000 [0045.178] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x10) returned 0x361780 [0045.178] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x2ff8ec | out: phkResult=0x2ff8ec*=0xa8) returned 0x0 [0045.179] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x2ff8e8, lpData=0x36b6e8, lpcbData=0x2ff8f0*=0x7a | out: lpType=0x2ff8e8*=0x2, lpData=0x36b6e8*=0x20, lpcbData=0x2ff8f0*=0x98) returned 0xea [0045.179] RegCloseKey (hKey=0xa8) returned 0x0 [0045.179] GetProcessHeap () returned 0x350000 [0045.179] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x361780 | out: hHeap=0x350000) returned 1 [0045.179] GetProcessHeap () returned 0x350000 [0045.179] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b770 | out: hHeap=0x350000) returned 1 [0045.179] GetProcessHeap () returned 0x350000 [0045.179] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b6e8 | out: hHeap=0x350000) returned 1 [0045.179] GetProcessHeap () returned 0x350000 [0045.179] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x36e950, Size=0xf2) returned 0x36b6e8 [0045.179] GetProcessHeap () returned 0x350000 [0045.179] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0xf2) returned 0x36a720 [0045.179] GetProcessHeap () returned 0x350000 [0045.179] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x36e950 [0045.179] GetProcessHeap () returned 0x350000 [0045.179] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x10) returned 0x361780 [0045.179] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x2ff8ec | out: phkResult=0x2ff8ec*=0xa8) returned 0x0 [0045.179] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x2ff8e8, lpData=0x36a720, lpcbData=0x2ff8f0*=0xf2 | out: lpType=0x2ff8e8*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x2ff8f0*=0x98) returned 0x0 [0045.179] RegCloseKey (hKey=0xa8) returned 0x0 [0045.179] GetProcessHeap () returned 0x350000 [0045.179] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x361780 | out: hHeap=0x350000) returned 1 [0045.179] GetProcessHeap () returned 0x350000 [0045.179] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1e) returned 0x36a3e8 [0045.179] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x2ff8ec | out: phkResult=0x2ff8ec*=0xa8) returned 0x0 [0045.180] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x2ff8e8, lpData=0x36a7b8, lpcbData=0x2ff8f0*=0x5a | out: lpType=0x2ff8e8*=0x0, lpData=0x36a7b8*=0x61, lpcbData=0x2ff8f0*=0x5a) returned 0x2 [0045.180] RegCloseKey (hKey=0xa8) returned 0x0 [0045.180] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x2ff900 | out: phkResult=0x2ff900*=0xa8) returned 0x0 [0045.180] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x2ff8fc, lpData=0x36a7b8, lpcbData=0x2ff904*=0x5a | out: lpType=0x2ff8fc*=0x2, lpData=0x36a7b8*=0x61, lpcbData=0x2ff904*=0x78) returned 0xea [0045.180] RegCloseKey (hKey=0xa8) returned 0x0 [0045.180] GetProcessHeap () returned 0x350000 [0045.180] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a3e8 | out: hHeap=0x350000) returned 1 [0045.180] GetProcessHeap () returned 0x350000 [0045.180] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e950 | out: hHeap=0x350000) returned 1 [0045.180] GetProcessHeap () returned 0x350000 [0045.180] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a720 | out: hHeap=0x350000) returned 1 [0045.180] GetProcessHeap () returned 0x350000 [0045.180] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x36b6e8, Size=0x1e2) returned 0x36a720 [0045.180] GetProcessHeap () returned 0x350000 [0045.180] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x1e2) returned 0x36a910 [0045.180] GetProcessHeap () returned 0x350000 [0045.180] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x36e950 [0045.181] GetProcessHeap () returned 0x350000 [0045.181] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x10) returned 0x361780 [0045.181] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x2ff8ec | out: phkResult=0x2ff8ec*=0xa8) returned 0x0 [0045.181] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x2ff8e8, lpData=0x36a910, lpcbData=0x2ff8f0*=0x1e2 | out: lpType=0x2ff8e8*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x2ff8f0*=0x98) returned 0x0 [0045.181] RegCloseKey (hKey=0xa8) returned 0x0 [0045.181] GetProcessHeap () returned 0x350000 [0045.181] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x361780 | out: hHeap=0x350000) returned 1 [0045.181] GetProcessHeap () returned 0x350000 [0045.181] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1e) returned 0x36a3e8 [0045.181] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x2ff8ec | out: phkResult=0x2ff8ec*=0xa8) returned 0x0 [0045.181] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x2ff8e8, lpData=0x36a9a8, lpcbData=0x2ff8f0*=0x14a | out: lpType=0x2ff8e8*=0x0, lpData=0x36a9a8*=0x7a, lpcbData=0x2ff8f0*=0x14a) returned 0x2 [0045.181] RegCloseKey (hKey=0xa8) returned 0x0 [0045.181] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x2ff900 | out: phkResult=0x2ff900*=0xa8) returned 0x0 [0045.181] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x2ff8fc, lpData=0x36a9a8, lpcbData=0x2ff904*=0x14a | out: lpType=0x2ff8fc*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x2ff904*=0x78) returned 0x0 [0045.181] RegCloseKey (hKey=0xa8) returned 0x0 [0045.181] GetProcessHeap () returned 0x350000 [0045.181] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a3e8 | out: hHeap=0x350000) returned 1 [0045.182] GetProcessHeap () returned 0x350000 [0045.182] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e950 | out: hHeap=0x350000) returned 1 [0045.182] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0x36a720, nSize=0xf1 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x99 [0045.182] GetProcessHeap () returned 0x350000 [0045.182] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a910 | out: hHeap=0x350000) returned 1 [0045.182] GetProcessHeap () returned 0x350000 [0045.182] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x364048 | out: hHeap=0x350000) returned 1 [0045.182] GetProcessHeap () returned 0x350000 [0045.182] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20a) returned 0x36a910 [0045.182] GetProcessHeap () returned 0x350000 [0045.182] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20a) returned 0x3706c0 [0045.182] GetProcessHeap () returned 0x350000 [0045.182] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20a) returned 0x3708d8 [0045.182] GetProcessHeap () returned 0x350000 [0045.182] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20a) returned 0x370af0 [0045.182] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x36a910, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cusersnextadminappdatalocalfast.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersnextadminappdatalocalfast.exe")) returned 0x49 [0045.182] GetProcessHeap () returned 0x350000 [0045.182] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20a) returned 0x370d08 [0045.182] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x370d08, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cusersnextadminappdatalocalfast.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersnextadminappdatalocalfast.exe")) returned 0x49 [0045.182] GetProcessHeap () returned 0x350000 [0045.182] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x370d08 | out: hHeap=0x350000) returned 1 [0045.182] GetProcessHeap () returned 0x350000 [0045.182] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20a) returned 0x370d08 [0045.182] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x370d08, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cusersnextadminappdatalocalfast.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersnextadminappdatalocalfast.exe")) returned 0x49 [0045.182] GetProcessHeap () returned 0x350000 [0045.182] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x370d08 | out: hHeap=0x350000) returned 1 [0045.183] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cusersnextadminappdatalocalfast.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersnextadminappdatalocalfast.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cusersnextadminappdatalocalfast.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\cusersnextadminappdatalocalfast.exe"), bFailIfExists=0) returned 1 [0045.192] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x2ff9e8 | out: phkResult=0x2ff9e8*=0xfc) returned 0x0 [0045.193] RegSetValueExW (in: hKey=0xfc, lpValueName="cusersnextadminappdatalocalfast", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cusersnextadminappdatalocalfast.exe", cbData=0x9e | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cusersnextadminappdatalocalfast.exe") returned 0x0 [0045.194] RegCloseKey (hKey=0xfc) returned 0x0 [0045.194] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x2ff9e4 | out: phkResult=0x2ff9e4*=0xfc) returned 0x0 [0045.194] RegSetValueExW (in: hKey=0xfc, lpValueName="cusersnextadminappdatalocalfast", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cusersnextadminappdatalocalfast.exe", cbData=0x9e | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cusersnextadminappdatalocalfast.exe") returned 0x0 [0045.195] RegCloseKey (hKey=0xfc) returned 0x0 [0045.195] GetProcessHeap () returned 0x350000 [0045.195] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x134) returned 0x36b6e8 [0045.195] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cusersnextadminappdatalocalfast.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersnextadminappdatalocalfast.exe"), lpNewFileName="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersnextadminappdatalocalfast.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersnextadminappdatalocalfast.exe"), bFailIfExists=1) returned 0 [0045.196] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cusersnextadminappdatalocalfast.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersnextadminappdatalocalfast.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersnextadminappdatalocalfast.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersnextadminappdatalocalfast.exe"), bFailIfExists=1) returned 1 [0045.204] GetProcessHeap () returned 0x350000 [0045.204] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b6e8 | out: hHeap=0x350000) returned 1 [0045.205] GetProcessHeap () returned 0x350000 [0045.205] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a910 | out: hHeap=0x350000) returned 1 [0045.205] GetProcessHeap () returned 0x350000 [0045.205] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3706c0 | out: hHeap=0x350000) returned 1 [0045.205] GetProcessHeap () returned 0x350000 [0045.205] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3708d8 | out: hHeap=0x350000) returned 1 [0045.205] GetProcessHeap () returned 0x350000 [0045.205] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x370af0 | out: hHeap=0x350000) returned 1 [0045.205] GetProcessHeap () returned 0x350000 [0045.205] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b4f8 | out: hHeap=0x350000) returned 1 [0045.205] GetProcessHeap () returned 0x350000 [0045.205] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x35f870 | out: hHeap=0x350000) returned 1 [0045.205] GetProcessHeap () returned 0x350000 [0045.205] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a720 | out: hHeap=0x350000) returned 1 [0045.205] GetProcessHeap () returned 0x350000 [0045.205] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20) returned 0x36a3e8 [0045.205] GetProcessHeap () returned 0x350000 [0045.205] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1e) returned 0x36a258 [0045.205] GetProcessHeap () returned 0x350000 [0045.205] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x1e) returned 0x36a2d0 [0045.205] GetProcessHeap () returned 0x350000 [0045.205] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x36b4f8 [0045.205] GetProcessHeap () returned 0x350000 [0045.205] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b4f8 | out: hHeap=0x350000) returned 1 [0045.205] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x36a258, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0045.206] GetProcessHeap () returned 0x350000 [0045.206] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a2d0 | out: hHeap=0x350000) returned 1 [0045.206] GetProcessHeap () returned 0x350000 [0045.206] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a3e8 | out: hHeap=0x350000) returned 1 [0045.206] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2ffa04, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2ffa04*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0045.206] GetProcessHeap () returned 0x350000 [0045.206] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a258 | out: hHeap=0x350000) returned 1 [0045.206] GetProcessHeap () returned 0x350000 [0045.206] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x28) returned 0x36b4b8 [0045.206] GetProcessHeap () returned 0x350000 [0045.206] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x361780 [0045.206] GetProcessHeap () returned 0x350000 [0045.206] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x190) returned 0x36b6e8 [0045.206] GetProcessHeap () returned 0x350000 [0045.206] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x70) returned 0x36b4f8 [0045.206] GetProcessHeap () returned 0x350000 [0045.206] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x6e) returned 0x36e950 [0045.207] GetProcessHeap () returned 0x350000 [0045.207] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x36e950, Size=0xda) returned 0x36a720 [0045.207] GetProcessHeap () returned 0x350000 [0045.207] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x184) returned 0x36a808 [0045.207] GetProcessHeap () returned 0x350000 [0045.207] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x361660 [0045.207] GetProcessHeap () returned 0x350000 [0045.207] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20a) returned 0x3706c0 [0045.207] GetProcessHeap () returned 0x350000 [0045.207] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x250) returned 0x3708d8 [0045.207] GetProcessHeap () returned 0x350000 [0045.207] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0xa0) returned 0x36e950 [0045.207] GetProcessHeap () returned 0x350000 [0045.207] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x96) returned 0x36a998 [0045.207] GetProcessHeap () returned 0x350000 [0045.207] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x96) returned 0x36aa38 [0045.207] GetProcessHeap () returned 0x350000 [0045.207] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x36aad8 [0045.207] GetProcessHeap () returned 0x350000 [0045.207] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36aad8 | out: hHeap=0x350000) returned 1 [0045.207] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;tlup.txt", lpDst=0x36a998, nSize=0x4b | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;tlup.txt") returned 0x4b [0045.207] GetProcessHeap () returned 0x350000 [0045.207] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36aa38 | out: hHeap=0x350000) returned 1 [0045.207] GetProcessHeap () returned 0x350000 [0045.208] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e950 | out: hHeap=0x350000) returned 1 [0045.208] GetProcessHeap () returned 0x350000 [0045.208] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x70) returned 0x36e950 [0045.208] GetProcessHeap () returned 0x350000 [0045.208] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x62) returned 0x36aa38 [0045.208] GetProcessHeap () returned 0x350000 [0045.208] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x62) returned 0x36aaa8 [0045.208] GetProcessHeap () returned 0x350000 [0045.208] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x370b30 [0045.208] GetProcessHeap () returned 0x350000 [0045.208] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x370b30 | out: hHeap=0x350000) returned 1 [0045.208] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x36aa38, nSize=0x31 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0045.208] GetProcessHeap () returned 0x350000 [0045.208] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36aaa8 | out: hHeap=0x350000) returned 1 [0045.208] GetProcessHeap () returned 0x350000 [0045.208] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x36aa38, Size=0xc2) returned 0x36aa38 [0045.208] GetProcessHeap () returned 0x350000 [0045.208] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0xc2) returned 0x370b30 [0045.208] GetProcessHeap () returned 0x350000 [0045.208] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x370c00 [0045.208] GetProcessHeap () returned 0x350000 [0045.208] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x370c00 | out: hHeap=0x350000) returned 1 [0045.209] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x36aa38, nSize=0x61 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0045.209] GetProcessHeap () returned 0x350000 [0045.209] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x370b30 | out: hHeap=0x350000) returned 1 [0045.209] GetProcessHeap () returned 0x350000 [0045.209] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e950 | out: hHeap=0x350000) returned 1 [0045.209] GetProcessHeap () returned 0x350000 [0045.209] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20a) returned 0x370b30 [0045.209] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x370b30, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cusersnextadminappdatalocalfast.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersnextadminappdatalocalfast.exe")) returned 0x49 [0045.209] GetProcessHeap () returned 0x350000 [0045.209] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x370b30 | out: hHeap=0x350000) returned 1 [0045.209] GetProcessHeap () returned 0x350000 [0045.209] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x24e) returned 0x370b30 [0045.209] GetProcessHeap () returned 0x350000 [0045.209] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x370b30, Size=0x3cc) returned 0x370b30 [0045.209] GetProcessHeap () returned 0x350000 [0045.209] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x98) returned 0x36e950 [0045.209] GetProcessHeap () returned 0x350000 [0045.209] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x36e950, Size=0xe0) returned 0x370f08 [0045.209] GetProcessHeap () returned 0x350000 [0045.209] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x6a) returned 0x36ab08 [0045.209] GetProcessHeap () returned 0x350000 [0045.209] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3706c0 | out: hHeap=0x350000) returned 1 [0045.209] GetProcessHeap () returned 0x350000 [0045.209] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3708d8 | out: hHeap=0x350000) returned 1 [0045.210] GetProcessHeap () returned 0x350000 [0045.210] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a998 | out: hHeap=0x350000) returned 1 [0045.210] GetProcessHeap () returned 0x350000 [0045.210] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36aa38 | out: hHeap=0x350000) returned 1 [0045.210] GetProcessHeap () returned 0x350000 [0045.210] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x361780 | out: hHeap=0x350000) returned 1 [0045.210] GetProcessHeap () returned 0x350000 [0045.210] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b6e8 | out: hHeap=0x350000) returned 1 [0045.210] GetProcessHeap () returned 0x350000 [0045.210] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b4f8 | out: hHeap=0x350000) returned 1 [0045.210] GetProcessHeap () returned 0x350000 [0045.210] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a808 | out: hHeap=0x350000) returned 1 [0045.210] GetProcessHeap () returned 0x350000 [0045.210] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20) returned 0x36a258 [0045.210] GetProcessHeap () returned 0x350000 [0045.210] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1e) returned 0x36a3e8 [0045.210] GetProcessHeap () returned 0x350000 [0045.210] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x1e) returned 0x36a2d0 [0045.210] GetProcessHeap () returned 0x350000 [0045.210] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x36b4f8 [0045.210] GetProcessHeap () returned 0x350000 [0045.210] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b4f8 | out: hHeap=0x350000) returned 1 [0045.210] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x36a3e8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0045.210] GetProcessHeap () returned 0x350000 [0045.210] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a2d0 | out: hHeap=0x350000) returned 1 [0045.210] GetProcessHeap () returned 0x350000 [0045.210] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a258 | out: hHeap=0x350000) returned 1 [0045.211] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2ffa04, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2ffa04*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0045.211] GetProcessHeap () returned 0x350000 [0045.211] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a3e8 | out: hHeap=0x350000) returned 1 [0045.211] GetProcessHeap () returned 0x350000 [0045.211] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x28) returned 0x36ec80 [0045.211] GetProcessHeap () returned 0x350000 [0045.211] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x361780 [0045.211] GetProcessHeap () returned 0x350000 [0045.211] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x190) returned 0x36b6e8 [0045.211] GetProcessHeap () returned 0x350000 [0045.211] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x70) returned 0x36b4f8 [0045.211] GetProcessHeap () returned 0x350000 [0045.211] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x6e) returned 0x36e950 [0045.211] GetProcessHeap () returned 0x350000 [0045.211] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x36e950, Size=0xda) returned 0x36a808 [0045.211] GetProcessHeap () returned 0x350000 [0045.211] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x184) returned 0x36a8f0 [0045.211] GetProcessHeap () returned 0x350000 [0045.211] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x361678 [0045.211] GetProcessHeap () returned 0x350000 [0045.211] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20a) returned 0x3706c0 [0045.212] GetProcessHeap () returned 0x350000 [0045.212] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x250) returned 0x3708d8 [0045.212] GetProcessHeap () returned 0x350000 [0045.212] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0xa0) returned 0x36e950 [0045.212] GetProcessHeap () returned 0x350000 [0045.212] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x96) returned 0x370ff0 [0045.212] GetProcessHeap () returned 0x350000 [0045.212] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x96) returned 0x371090 [0045.212] GetProcessHeap () returned 0x350000 [0045.212] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x371130 [0045.212] GetProcessHeap () returned 0x350000 [0045.212] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x371130 | out: hHeap=0x350000) returned 1 [0045.212] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;tlup.txt", lpDst=0x370ff0, nSize=0x4b | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;tlup.txt") returned 0x4b [0045.212] GetProcessHeap () returned 0x350000 [0045.212] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x371090 | out: hHeap=0x350000) returned 1 [0045.212] GetProcessHeap () returned 0x350000 [0045.212] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e950 | out: hHeap=0x350000) returned 1 [0045.212] GetProcessHeap () returned 0x350000 [0045.212] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x70) returned 0x36aa80 [0045.212] GetProcessHeap () returned 0x350000 [0045.212] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x62) returned 0x36e950 [0045.212] GetProcessHeap () returned 0x350000 [0045.212] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x62) returned 0x371090 [0045.212] GetProcessHeap () returned 0x350000 [0045.212] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x371100 [0045.212] GetProcessHeap () returned 0x350000 [0045.212] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x371100 | out: hHeap=0x350000) returned 1 [0045.213] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x36e950, nSize=0x31 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0045.213] GetProcessHeap () returned 0x350000 [0045.213] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x371090 | out: hHeap=0x350000) returned 1 [0045.213] GetProcessHeap () returned 0x350000 [0045.213] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x36e950, Size=0xc2) returned 0x36e950 [0045.213] GetProcessHeap () returned 0x350000 [0045.213] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0xc2) returned 0x371090 [0045.213] GetProcessHeap () returned 0x350000 [0045.213] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x371160 [0045.213] GetProcessHeap () returned 0x350000 [0045.213] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x371160 | out: hHeap=0x350000) returned 1 [0045.213] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x36e950, nSize=0x61 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0045.213] GetProcessHeap () returned 0x350000 [0045.213] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x371090 | out: hHeap=0x350000) returned 1 [0045.213] GetProcessHeap () returned 0x350000 [0045.213] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36aa80 | out: hHeap=0x350000) returned 1 [0045.213] GetProcessHeap () returned 0x350000 [0045.213] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20a) returned 0x371090 [0045.213] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x371090, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cusersnextadminappdatalocalfast.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersnextadminappdatalocalfast.exe")) returned 0x49 [0045.213] GetProcessHeap () returned 0x350000 [0045.213] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x371090 | out: hHeap=0x350000) returned 1 [0045.214] GetProcessHeap () returned 0x350000 [0045.214] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x182) returned 0x371090 [0045.214] GetProcessHeap () returned 0x350000 [0045.214] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x24e) returned 0x371220 [0045.214] GetProcessHeap () returned 0x350000 [0045.214] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x98) returned 0x371478 [0045.214] GetProcessHeap () returned 0x350000 [0045.214] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x371478, Size=0xe0) returned 0x371478 [0045.214] GetProcessHeap () returned 0x350000 [0045.214] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x6a) returned 0x36aa80 [0045.214] GetProcessHeap () returned 0x350000 [0045.214] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3706c0 | out: hHeap=0x350000) returned 1 [0045.214] GetProcessHeap () returned 0x350000 [0045.214] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3708d8 | out: hHeap=0x350000) returned 1 [0045.214] GetProcessHeap () returned 0x350000 [0045.214] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x370ff0 | out: hHeap=0x350000) returned 1 [0045.214] GetProcessHeap () returned 0x350000 [0045.214] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e950 | out: hHeap=0x350000) returned 1 [0045.214] GetProcessHeap () returned 0x350000 [0045.214] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x361780 | out: hHeap=0x350000) returned 1 [0045.214] GetProcessHeap () returned 0x350000 [0045.215] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b6e8 | out: hHeap=0x350000) returned 1 [0045.215] GetProcessHeap () returned 0x350000 [0045.215] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b4f8 | out: hHeap=0x350000) returned 1 [0045.215] GetProcessHeap () returned 0x350000 [0045.215] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a8f0 | out: hHeap=0x350000) returned 1 [0045.215] GetProcessHeap () returned 0x350000 [0045.215] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x14) returned 0x36e1c8 [0045.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12621e5, lpParameter=0x36e1c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa8 [0045.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1262291, lpParameter=0x2ffa38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x118 [0045.232] GetProcessHeap () returned 0x350000 [0045.232] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x14) returned 0x36e228 [0045.232] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1262058, lpParameter=0x36e228, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c [0045.233] GetProcessHeap () returned 0x350000 [0045.233] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x14) returned 0x36e268 [0045.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x126196d, lpParameter=0x36e268, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120 [0045.234] GetProcessHeap () returned 0x350000 [0045.234] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x14) returned 0x36e2a8 [0045.234] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1261bbc, lpParameter=0x36e2a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0045.235] WaitForSingleObject (hHandle=0x120, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x9ec Thread: id = 11 os_tid = 0x1c0 [0045.222] GetProcessHeap () returned 0x350000 [0045.222] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20) returned 0x36a3e8 [0045.222] GetProcessHeap () returned 0x350000 [0045.222] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x14) returned 0x36e208 [0045.222] GetProcessHeap () returned 0x350000 [0045.222] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x14) returned 0x36e228 [0045.222] GetProcessHeap () returned 0x350000 [0045.222] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x370ff0 [0045.223] GetProcessHeap () returned 0x350000 [0045.223] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x370ff0 | out: hHeap=0x350000) returned 1 [0045.223] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x36e208, nSize=0xa | out: lpDst="") returned 0x1c [0045.223] GetProcessHeap () returned 0x350000 [0045.223] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e228 | out: hHeap=0x350000) returned 1 [0045.223] GetProcessHeap () returned 0x350000 [0045.223] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x36e208, Size=0x26) returned 0x36e108 [0045.223] GetProcessHeap () returned 0x350000 [0045.223] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x26) returned 0x370ff0 [0045.223] GetProcessHeap () returned 0x350000 [0045.223] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x36b4f8 [0045.223] GetProcessHeap () returned 0x350000 [0045.223] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b4f8 | out: hHeap=0x350000) returned 1 [0045.223] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x36e108, nSize=0x13 | out: lpDst="") returned 0x1c [0045.223] GetProcessHeap () returned 0x350000 [0045.223] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x370ff0 | out: hHeap=0x350000) returned 1 [0045.223] GetProcessHeap () returned 0x350000 [0045.223] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x36e108, Size=0x4a) returned 0x370ff0 [0045.223] GetProcessHeap () returned 0x350000 [0045.223] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x4a) returned 0x36f6d8 [0045.223] GetProcessHeap () returned 0x350000 [0045.223] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x36b4f8 [0045.223] GetProcessHeap () returned 0x350000 [0045.223] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b4f8 | out: hHeap=0x350000) returned 1 [0045.223] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x370ff0, nSize=0x25 | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0045.224] GetProcessHeap () returned 0x350000 [0045.224] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36f6d8 | out: hHeap=0x350000) returned 1 [0045.224] GetProcessHeap () returned 0x350000 [0045.224] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a3e8 | out: hHeap=0x350000) returned 1 [0045.224] GetProcessHeap () returned 0x350000 [0045.224] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x50) returned 0x36f6d8 [0045.224] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0045.225] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0045.225] Wow64DisableWow64FsRedirection (in: OldValue=0xc0fe5c | out: OldValue=0xc0fe5c*=0x0) returned 1 [0045.225] GetProcessHeap () returned 0x350000 [0045.225] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36f6d8 | out: hHeap=0x350000) returned 1 [0045.225] CreatePipe (in: hReadPipe=0xc0fe50, hWritePipe=0xc0fe4c, lpPipeAttributes=0xc0fe6c, nSize=0x0 | out: hReadPipe=0xc0fe50*=0xf8, hWritePipe=0xc0fe4c*=0xa4) returned 1 [0045.226] CreatePipe (in: hReadPipe=0xc0fe54, hWritePipe=0xc0fe58, lpPipeAttributes=0xc0fe6c, nSize=0x0 | out: hReadPipe=0xc0fe54*=0x100, hWritePipe=0xc0fe58*=0x104) returned 1 [0045.226] SetHandleInformation (hObject=0xa4, dwMask=0x1, dwFlags=0x0) returned 1 [0045.226] SetHandleInformation (hObject=0x100, dwMask=0x1, dwFlags=0x0) returned 1 [0045.226] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0xc0fe88*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xf8, hStdOutput=0x104, hStdError=0x104), lpProcessInformation=0xc0fe78 | out: lpCommandLine=0x0, lpProcessInformation=0xc0fe78*(hProcess=0x15c, hThread=0x158, dwProcessId=0x318, dwThreadId=0x6c0)) returned 1 [0045.463] WriteFile (in: hFile=0xa4, lpBuffer=0x36ea28*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0xc0fe68, lpOverlapped=0x0 | out: lpBuffer=0x36ea28*, lpNumberOfBytesWritten=0xc0fe68*=0xc2, lpOverlapped=0x0) returned 1 [0045.463] WaitForSingleObject (hHandle=0x15c, dwMilliseconds=0xffffffff) Thread: id = 12 os_tid = 0x174 [0045.228] GetProcessHeap () returned 0x350000 [0045.228] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20) returned 0x36a3e8 [0045.228] GetProcessHeap () returned 0x350000 [0045.228] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x14) returned 0x36e208 [0045.228] GetProcessHeap () returned 0x350000 [0045.228] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x14) returned 0x36e228 [0045.228] GetProcessHeap () returned 0x350000 [0045.228] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x36b4f8 [0045.228] GetProcessHeap () returned 0x350000 [0045.229] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b4f8 | out: hHeap=0x350000) returned 1 [0045.229] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x36e208, nSize=0xa | out: lpDst="") returned 0x1c [0045.229] GetProcessHeap () returned 0x350000 [0045.229] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e228 | out: hHeap=0x350000) returned 1 [0045.229] GetProcessHeap () returned 0x350000 [0045.229] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x36e208, Size=0x26) returned 0x36e108 [0045.229] GetProcessHeap () returned 0x350000 [0045.229] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x26) returned 0x371048 [0045.229] GetProcessHeap () returned 0x350000 [0045.229] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x36b4f8 [0045.229] GetProcessHeap () returned 0x350000 [0045.229] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b4f8 | out: hHeap=0x350000) returned 1 [0045.229] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x36e108, nSize=0x13 | out: lpDst="") returned 0x1c [0045.229] GetProcessHeap () returned 0x350000 [0045.229] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x371048 | out: hHeap=0x350000) returned 1 [0045.229] GetProcessHeap () returned 0x350000 [0045.229] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x36e108, Size=0x4a) returned 0x36b4f8 [0045.229] GetProcessHeap () returned 0x350000 [0045.229] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x4a) returned 0x36f6d8 [0045.229] GetProcessHeap () returned 0x350000 [0045.229] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x36e950 [0045.229] GetProcessHeap () returned 0x350000 [0045.229] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e950 | out: hHeap=0x350000) returned 1 [0045.229] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x36b4f8, nSize=0x25 | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0045.229] GetProcessHeap () returned 0x350000 [0045.229] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36f6d8 | out: hHeap=0x350000) returned 1 [0045.229] GetProcessHeap () returned 0x350000 [0045.229] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a3e8 | out: hHeap=0x350000) returned 1 [0045.229] GetProcessHeap () returned 0x350000 [0045.229] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x50) returned 0x36f6d8 [0045.230] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0045.230] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0045.230] Wow64DisableWow64FsRedirection (in: OldValue=0xe0fc24 | out: OldValue=0xe0fc24*=0x0) returned 1 [0045.230] GetProcessHeap () returned 0x350000 [0045.230] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36f6d8 | out: hHeap=0x350000) returned 1 [0045.230] CreatePipe (in: hReadPipe=0xe0fc18, hWritePipe=0xe0fc14, lpPipeAttributes=0xe0fc34, nSize=0x0 | out: hReadPipe=0xe0fc18*=0x108, hWritePipe=0xe0fc14*=0x10c) returned 1 [0045.230] CreatePipe (in: hReadPipe=0xe0fc1c, hWritePipe=0xe0fc20, lpPipeAttributes=0xe0fc34, nSize=0x0 | out: hReadPipe=0xe0fc1c*=0x110, hWritePipe=0xe0fc20*=0x114) returned 1 [0045.230] SetHandleInformation (hObject=0x10c, dwMask=0x1, dwFlags=0x0) returned 1 [0045.230] SetHandleInformation (hObject=0x110, dwMask=0x1, dwFlags=0x0) returned 1 [0045.230] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0xe0fc50*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x108, hStdOutput=0x114, hStdError=0x114), lpProcessInformation=0xe0fc40 | out: lpCommandLine=0x0, lpProcessInformation=0xe0fc40*(hProcess=0x140, hThread=0x128, dwProcessId=0x7dc, dwThreadId=0x634)) returned 1 [0045.463] WriteFile (in: hFile=0x10c, lpBuffer=0x36e0a0*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0xe0fc30, lpOverlapped=0x0 | out: lpBuffer=0x36e0a0*, lpNumberOfBytesWritten=0xe0fc30*=0x5b, lpOverlapped=0x0) returned 1 [0045.463] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0xffffffff) Thread: id = 13 os_tid = 0x414 [0045.238] GetProcessHeap () returned 0x350000 [0045.240] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x440) returned 0x372b38 [0045.240] GetProcessHeap () returned 0x350000 [0045.240] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x30) returned 0x36ed00 [0045.240] GetCurrentProcess () returned 0xffffffff [0045.241] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x104fe80 | out: TokenHandle=0x104fe80*=0x128) returned 1 [0045.241] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x104fe78 | out: lpLuid=0x104fe78*(LowPart=0x14, HighPart=0)) returned 1 [0045.244] AdjustTokenPrivileges (in: TokenHandle=0x128, DisableAllPrivileges=0, NewState=0x104fe68*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0045.244] CloseHandle (hObject=0x128) returned 1 [0045.244] GetProcessHeap () returned 0x350000 [0045.244] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ed00 | out: hHeap=0x350000) returned 1 [0045.244] GetProcessHeap () returned 0x350000 [0045.244] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x434) returned 0x374120 [0045.244] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x128 [0045.252] Process32FirstW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0045.253] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0045.253] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0045.254] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.254] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0045.255] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.255] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0045.256] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0045.257] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0045.257] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0045.258] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.258] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.259] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.259] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.260] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.260] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0045.261] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.262] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.262] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0045.263] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0045.264] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0045.264] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.265] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.266] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0045.267] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="clock-drives.exe")) returned 1 [0045.267] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stanford_robots.exe")) returned 1 [0045.268] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0045.269] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="materials rules.exe")) returned 1 [0045.269] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pameladecimalinvasion.exe")) returned 1 [0045.270] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlock.exe")) returned 1 [0045.271] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reachsmartvirtue.exe")) returned 1 [0045.272] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="citation-ooo.exe")) returned 1 [0045.272] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmc_forest_closely.exe")) returned 1 [0045.273] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="realized_featured_doc.exe")) returned 1 [0045.274] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="instructorspeechthemes.exe")) returned 1 [0045.274] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wide thereafter details.exe")) returned 1 [0045.275] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="health_issued_laser.exe")) returned 1 [0045.276] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bite.exe")) returned 1 [0045.276] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pocket present.exe")) returned 1 [0045.277] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="asn.exe")) returned 1 [0045.278] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0045.278] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0045.279] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0045.309] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0045.309] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0045.310] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0045.310] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0045.311] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0045.312] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0045.312] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0045.313] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0045.313] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0045.314] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0045.314] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0045.315] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0045.315] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0045.316] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0045.316] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0045.317] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0x80c) returned 0x140 [0045.317] TerminateProcess (hProcess=0x140, uExitCode=0x0) returned 1 [0045.321] CloseHandle (hObject=0x140) returned 1 [0045.321] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0045.322] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0045.323] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0045.324] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0045.325] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0045.326] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0x85c) returned 0x140 [0045.326] TerminateProcess (hProcess=0x140, uExitCode=0x0) returned 1 [0045.328] CloseHandle (hObject=0x140) returned 1 [0045.328] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0045.329] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0045.330] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0045.331] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0045.332] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0045.332] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0045.333] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0045.334] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0045.335] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0045.336] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0045.337] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0045.337] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0045.338] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0045.339] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0045.340] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0045.341] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0045.341] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0045.347] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0045.348] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0045.348] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0045.349] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0045.350] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hotel-establish.exe")) returned 1 [0045.351] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ranges.exe")) returned 1 [0045.352] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0045.353] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0045.353] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.354] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersnextadminappdatalocalfast.exe")) returned 1 [0045.355] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersnextadminappdatalocalfast.exe")) returned 1 [0045.356] Process32NextW (in: hSnapshot=0x128, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersnextadminappdatalocalfast.exe")) returned 0 [0045.356] CloseHandle (hObject=0x128) returned 1 [0045.356] Sleep (dwMilliseconds=0x1f4) [0049.368] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x160 [0049.407] Process32FirstW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0049.408] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0049.409] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0049.409] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.410] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0049.411] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.411] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0049.412] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0049.413] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0049.413] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0049.414] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.414] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.415] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.416] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.416] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.417] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0049.418] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.418] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.419] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0049.420] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0049.420] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0049.421] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.422] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.422] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0049.423] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="clock-drives.exe")) returned 1 [0049.423] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stanford_robots.exe")) returned 1 [0049.424] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0049.425] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="materials rules.exe")) returned 1 [0049.425] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pameladecimalinvasion.exe")) returned 1 [0049.426] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlock.exe")) returned 1 [0049.427] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reachsmartvirtue.exe")) returned 1 [0049.427] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="citation-ooo.exe")) returned 1 [0049.428] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmc_forest_closely.exe")) returned 1 [0049.647] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="realized_featured_doc.exe")) returned 1 [0049.648] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="instructorspeechthemes.exe")) returned 1 [0049.649] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wide thereafter details.exe")) returned 1 [0049.649] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="health_issued_laser.exe")) returned 1 [0049.650] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bite.exe")) returned 1 [0049.650] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pocket present.exe")) returned 1 [0049.651] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="asn.exe")) returned 1 [0049.652] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0049.652] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0049.653] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0049.654] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0049.654] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0049.655] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0049.656] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0049.656] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0049.657] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0049.658] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0049.658] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0049.659] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0049.660] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0049.660] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0049.661] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0049.661] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0049.662] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0049.663] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0049.663] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0049.664] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0049.665] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0049.666] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0049.667] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0049.668] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0049.669] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0049.670] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0049.671] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0049.672] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0049.673] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0049.674] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0049.675] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0049.676] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0049.677] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0049.678] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0049.869] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0049.870] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0049.871] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0049.872] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0049.873] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0049.874] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0049.875] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0049.876] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0049.877] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hotel-establish.exe")) returned 1 [0049.878] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ranges.exe")) returned 1 [0049.879] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0049.880] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0049.880] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.881] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersnextadminappdatalocalfast.exe")) returned 1 [0049.882] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersnextadminappdatalocalfast.exe")) returned 1 [0049.883] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0049.884] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0049.885] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0049.886] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0049.887] Process32NextW (in: hSnapshot=0x160, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0049.887] CloseHandle (hObject=0x160) returned 1 [0049.887] Sleep (dwMilliseconds=0x1f4) [0052.475] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1bc [0052.480] Process32FirstW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0052.480] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0052.481] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0052.482] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.482] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0052.483] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.484] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0052.484] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0052.485] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0052.485] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0052.486] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.487] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.488] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.489] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.489] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.490] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0052.490] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.491] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.491] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0052.492] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0052.493] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0052.493] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.494] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.495] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0052.495] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="clock-drives.exe")) returned 1 [0052.496] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stanford_robots.exe")) returned 1 [0052.497] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0052.497] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="materials rules.exe")) returned 1 [0052.498] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pameladecimalinvasion.exe")) returned 1 [0052.499] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlock.exe")) returned 1 [0052.499] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reachsmartvirtue.exe")) returned 1 [0052.500] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="citation-ooo.exe")) returned 1 [0052.501] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmc_forest_closely.exe")) returned 1 [0052.501] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="realized_featured_doc.exe")) returned 1 [0052.502] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="instructorspeechthemes.exe")) returned 1 [0052.503] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wide thereafter details.exe")) returned 1 [0052.503] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="health_issued_laser.exe")) returned 1 [0052.504] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bite.exe")) returned 1 [0052.505] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pocket present.exe")) returned 1 [0052.505] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="asn.exe")) returned 1 [0052.506] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0052.507] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0052.507] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0052.508] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0052.509] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0052.509] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0052.510] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0052.511] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0052.511] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0052.512] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0052.513] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0052.513] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0052.514] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0052.515] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0052.515] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0052.516] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0052.517] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0052.517] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0052.821] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0052.822] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0052.823] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0052.824] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0052.825] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0052.826] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0052.827] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0052.828] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0052.829] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0052.830] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0052.830] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0052.831] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0052.832] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0052.833] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0052.833] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0052.834] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0052.835] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0052.836] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0052.837] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0052.838] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0052.839] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0052.840] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0052.841] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0052.841] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0052.842] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hotel-establish.exe")) returned 1 [0052.843] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ranges.exe")) returned 1 [0052.844] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0052.845] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0052.846] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.847] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersnextadminappdatalocalfast.exe")) returned 1 [0052.848] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersnextadminappdatalocalfast.exe")) returned 1 [0052.849] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0052.850] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0052.851] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0052.851] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0052.852] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0052.853] CloseHandle (hObject=0x1bc) returned 1 [0052.853] Sleep (dwMilliseconds=0x1f4) [0053.520] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b8 [0053.525] Process32FirstW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0053.526] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0053.527] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0053.527] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.528] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0053.529] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.529] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0053.530] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0053.530] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0053.531] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0053.532] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.532] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.533] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.534] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.534] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.535] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0053.536] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.536] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.537] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0053.538] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0053.538] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0053.539] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.540] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.540] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0053.541] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="clock-drives.exe")) returned 1 [0053.542] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stanford_robots.exe")) returned 1 [0053.542] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0053.543] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="materials rules.exe")) returned 1 [0053.543] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pameladecimalinvasion.exe")) returned 1 [0053.544] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlock.exe")) returned 1 [0053.545] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reachsmartvirtue.exe")) returned 1 [0053.545] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="citation-ooo.exe")) returned 1 [0053.546] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmc_forest_closely.exe")) returned 1 [0053.547] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="realized_featured_doc.exe")) returned 1 [0053.548] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="instructorspeechthemes.exe")) returned 1 [0053.549] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wide thereafter details.exe")) returned 1 [0053.550] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="health_issued_laser.exe")) returned 1 [0053.550] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bite.exe")) returned 1 [0053.551] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pocket present.exe")) returned 1 [0053.552] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="asn.exe")) returned 1 [0053.552] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0053.553] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0053.553] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0053.554] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0053.555] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0053.555] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0053.556] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0053.557] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0053.557] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0053.558] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0053.558] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0053.559] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0053.559] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0053.560] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0053.561] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0053.561] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0053.562] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0053.563] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0053.825] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0053.826] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0053.827] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0053.829] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0053.830] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0053.831] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0053.831] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0053.832] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0053.833] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0053.834] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0053.835] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0053.836] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0053.836] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0053.837] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0053.838] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0053.839] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0053.840] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0053.841] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0053.841] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0053.842] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0053.843] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0053.844] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0053.845] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0053.846] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0053.846] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hotel-establish.exe")) returned 1 [0053.847] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ranges.exe")) returned 1 [0053.848] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0053.849] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0053.849] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.850] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersnextadminappdatalocalfast.exe")) returned 1 [0053.851] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersnextadminappdatalocalfast.exe")) returned 1 [0053.852] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0053.855] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0053.856] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0053.856] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0053.857] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0053.857] CloseHandle (hObject=0x1b8) returned 1 [0053.857] Sleep (dwMilliseconds=0x1f4) [0055.221] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c8 [0055.225] Process32FirstW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0055.226] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0055.226] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0055.227] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.227] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0055.266] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.267] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0055.268] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0055.273] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0055.274] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0055.275] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.275] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.277] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.278] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.279] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.280] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0055.281] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.281] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.282] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0055.283] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0055.284] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0055.287] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.287] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.288] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0055.289] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="clock-drives.exe")) returned 1 [0055.289] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stanford_robots.exe")) returned 1 [0055.290] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0055.291] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="materials rules.exe")) returned 1 [0055.291] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pameladecimalinvasion.exe")) returned 1 [0055.292] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlock.exe")) returned 1 [0055.293] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reachsmartvirtue.exe")) returned 1 [0055.293] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="citation-ooo.exe")) returned 1 [0055.294] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmc_forest_closely.exe")) returned 1 [0055.295] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="realized_featured_doc.exe")) returned 1 [0055.295] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="instructorspeechthemes.exe")) returned 1 [0055.296] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wide thereafter details.exe")) returned 1 [0055.297] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="health_issued_laser.exe")) returned 1 [0055.297] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bite.exe")) returned 1 [0055.298] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pocket present.exe")) returned 1 [0055.298] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="asn.exe")) returned 1 [0055.299] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0055.300] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0055.300] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0055.301] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0055.302] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0055.302] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0055.303] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0055.303] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0055.304] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0055.305] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0055.305] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0055.306] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0055.307] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0055.307] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0055.308] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0055.308] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0055.309] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0055.310] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0057.948] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0057.948] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0057.949] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0057.950] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0057.994] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0057.994] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0057.995] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0057.996] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0057.997] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0057.998] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0057.998] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0057.999] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0058.000] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0058.001] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0058.002] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0058.003] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0058.003] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0058.004] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0058.005] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0058.006] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0058.006] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0058.007] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0058.008] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0058.008] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0058.010] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hotel-establish.exe")) returned 1 [0058.010] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ranges.exe")) returned 1 [0058.011] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0058.012] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0058.013] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0058.013] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersnextadminappdatalocalfast.exe")) returned 1 [0058.014] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersnextadminappdatalocalfast.exe")) returned 1 [0058.015] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0058.015] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0058.016] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.016] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.017] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x318, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0058.017] Process32NextW (in: hSnapshot=0x1c8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x318, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0058.018] CloseHandle (hObject=0x1c8) returned 1 [0058.018] Sleep (dwMilliseconds=0x1f4) [0059.161] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b8 [0059.169] Process32FirstW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0059.170] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0059.170] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0059.171] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.171] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0059.172] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.172] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0059.173] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0059.173] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0059.174] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0059.174] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.175] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.176] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.176] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.177] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.177] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0059.178] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.178] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.179] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0059.179] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0059.180] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0059.181] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.181] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.182] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0059.182] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="clock-drives.exe")) returned 1 [0059.183] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stanford_robots.exe")) returned 1 [0059.183] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0059.184] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="materials rules.exe")) returned 1 [0059.184] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pameladecimalinvasion.exe")) returned 1 [0059.185] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlock.exe")) returned 1 [0059.185] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reachsmartvirtue.exe")) returned 1 [0059.186] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="citation-ooo.exe")) returned 1 [0059.187] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmc_forest_closely.exe")) returned 1 [0059.187] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="realized_featured_doc.exe")) returned 1 [0059.188] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="instructorspeechthemes.exe")) returned 1 [0059.188] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wide thereafter details.exe")) returned 1 [0059.189] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="health_issued_laser.exe")) returned 1 [0059.189] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bite.exe")) returned 1 [0059.189] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pocket present.exe")) returned 1 [0059.190] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="asn.exe")) returned 1 [0059.191] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0059.191] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0059.192] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0059.192] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0059.193] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0059.193] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0059.194] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0059.520] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0059.521] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0059.521] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0059.523] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0059.524] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0059.524] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0059.525] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0059.526] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0059.527] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0059.527] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0059.528] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0059.528] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0059.529] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0059.530] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0059.531] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0059.532] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0059.533] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0059.534] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0059.535] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0059.536] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0059.537] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0059.539] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0059.540] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0059.541] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0059.542] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0059.546] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0059.547] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0059.548] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0059.549] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0059.550] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0059.551] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0059.552] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0059.553] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0059.554] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0059.555] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0059.556] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hotel-establish.exe")) returned 1 [0059.557] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ranges.exe")) returned 1 [0059.558] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0059.559] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0059.559] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.560] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersnextadminappdatalocalfast.exe")) returned 1 [0059.561] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersnextadminappdatalocalfast.exe")) returned 1 [0059.562] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0060.186] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0060.186] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.187] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.188] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x318, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0060.188] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0060.189] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 0 [0060.190] CloseHandle (hObject=0x1b8) returned 1 [0060.190] Sleep (dwMilliseconds=0x1f4) [0061.035] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b8 [0061.040] Process32FirstW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0061.041] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0061.041] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0061.042] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.043] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0061.044] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.044] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0061.045] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0061.045] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0061.046] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0061.047] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.047] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.048] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.049] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.049] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.050] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0061.051] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.051] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.052] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0061.053] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0061.053] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0061.054] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.054] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0061.055] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0061.056] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="clock-drives.exe")) returned 1 [0061.056] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stanford_robots.exe")) returned 1 [0061.057] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0061.058] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="materials rules.exe")) returned 1 [0061.058] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pameladecimalinvasion.exe")) returned 1 [0061.059] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlock.exe")) returned 1 [0061.060] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reachsmartvirtue.exe")) returned 1 [0061.061] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="citation-ooo.exe")) returned 1 [0061.061] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmc_forest_closely.exe")) returned 1 [0061.062] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="realized_featured_doc.exe")) returned 1 [0061.063] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="instructorspeechthemes.exe")) returned 1 [0061.063] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wide thereafter details.exe")) returned 1 [0061.064] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="health_issued_laser.exe")) returned 1 [0061.064] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bite.exe")) returned 1 [0061.065] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pocket present.exe")) returned 1 [0061.066] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="asn.exe")) returned 1 [0061.067] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0061.067] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0061.068] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0061.069] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0061.069] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0061.070] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0061.071] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0061.071] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0061.290] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0061.290] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0061.291] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0061.291] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0061.292] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0061.293] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0061.293] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0061.294] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0061.294] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0061.295] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0061.296] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0061.297] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0061.298] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0061.299] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0061.300] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0061.301] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0061.302] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0061.303] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0061.304] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0061.305] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0061.305] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0061.306] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0061.307] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0061.308] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0061.309] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0061.310] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0061.310] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0061.311] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0061.312] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0061.313] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0061.314] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0061.314] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0061.315] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0061.316] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0061.317] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hotel-establish.exe")) returned 1 [0061.318] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ranges.exe")) returned 1 [0061.318] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0061.319] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0061.320] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0061.321] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersnextadminappdatalocalfast.exe")) returned 1 [0061.321] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersnextadminappdatalocalfast.exe")) returned 1 [0061.322] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0061.323] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0061.323] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0061.324] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0061.460] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x318, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0061.461] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0061.461] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 0 [0061.462] CloseHandle (hObject=0x1b8) returned 1 [0061.462] Sleep (dwMilliseconds=0x1f4) [0062.113] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b8 [0062.117] Process32FirstW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0062.117] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0062.119] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0062.120] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.120] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0062.121] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.121] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0062.122] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0062.122] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0062.123] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0062.123] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.124] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.124] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.125] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.125] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.126] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0062.126] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.127] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.127] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0062.128] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0062.128] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0062.129] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.129] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0062.130] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0062.130] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="clock-drives.exe")) returned 1 [0062.131] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stanford_robots.exe")) returned 1 [0062.131] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0062.131] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="materials rules.exe")) returned 1 [0062.132] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pameladecimalinvasion.exe")) returned 1 [0062.132] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlock.exe")) returned 1 [0062.133] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reachsmartvirtue.exe")) returned 1 [0062.133] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="citation-ooo.exe")) returned 1 [0062.134] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmc_forest_closely.exe")) returned 1 [0062.134] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="realized_featured_doc.exe")) returned 1 [0062.135] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="instructorspeechthemes.exe")) returned 1 [0062.135] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wide thereafter details.exe")) returned 1 [0062.136] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="health_issued_laser.exe")) returned 1 [0062.136] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bite.exe")) returned 1 [0062.137] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pocket present.exe")) returned 1 [0062.137] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="asn.exe")) returned 1 [0062.138] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0062.138] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0062.139] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0062.139] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0062.140] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0062.140] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0062.141] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0062.141] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0062.142] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0062.142] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0062.143] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0062.143] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0062.144] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0062.144] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0062.145] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0062.145] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0062.146] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0062.146] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0062.147] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0062.147] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0062.148] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0062.149] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0062.150] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0062.150] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0062.151] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0062.252] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0062.252] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0062.253] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0062.254] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0062.254] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0062.255] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0062.256] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0062.256] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0062.257] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0062.258] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0062.259] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0062.259] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0062.260] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0062.260] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0062.261] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0062.262] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0062.262] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0062.263] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hotel-establish.exe")) returned 1 [0062.264] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ranges.exe")) returned 1 [0062.264] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0062.265] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0062.265] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0062.266] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersnextadminappdatalocalfast.exe")) returned 1 [0062.266] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersnextadminappdatalocalfast.exe")) returned 1 [0062.267] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0062.268] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0062.268] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0062.269] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0062.270] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x318, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0062.270] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0062.271] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 0 [0062.271] CloseHandle (hObject=0x1b8) returned 1 [0062.271] Sleep (dwMilliseconds=0x1f4) [0062.833] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b8 [0062.837] Process32FirstW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0062.837] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0062.838] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0062.838] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.839] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0062.839] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.840] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0062.840] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0062.841] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0062.841] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0062.842] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.842] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.843] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.843] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.844] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.844] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0062.845] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.845] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.846] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0062.846] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0062.847] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0062.847] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.848] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0062.848] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0062.849] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="clock-drives.exe")) returned 1 [0062.849] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stanford_robots.exe")) returned 1 [0062.850] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0062.850] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="materials rules.exe")) returned 1 [0062.851] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pameladecimalinvasion.exe")) returned 1 [0062.851] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlock.exe")) returned 1 [0062.852] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reachsmartvirtue.exe")) returned 1 [0062.852] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="citation-ooo.exe")) returned 1 [0062.853] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmc_forest_closely.exe")) returned 1 [0062.853] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="realized_featured_doc.exe")) returned 1 [0062.854] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="instructorspeechthemes.exe")) returned 1 [0062.854] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wide thereafter details.exe")) returned 1 [0062.855] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="health_issued_laser.exe")) returned 1 [0062.855] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bite.exe")) returned 1 [0062.856] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pocket present.exe")) returned 1 [0062.856] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="asn.exe")) returned 1 [0062.857] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0062.857] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0062.858] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0062.859] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0062.859] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0062.860] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0062.861] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0062.861] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0062.862] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0062.862] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0062.863] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0062.864] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0062.864] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0062.865] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0062.865] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0062.865] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0062.866] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0062.979] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0062.979] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0062.980] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0062.981] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0062.982] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0062.982] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0062.983] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0062.984] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0062.985] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0062.987] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0062.988] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0062.989] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0062.989] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0062.990] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0062.991] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0062.991] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0062.992] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0062.993] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0062.994] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0062.995] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0062.995] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0062.996] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0062.997] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0062.997] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0062.998] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0062.999] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hotel-establish.exe")) returned 1 [0062.999] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ranges.exe")) returned 1 [0063.000] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0063.001] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0063.001] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0063.002] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersnextadminappdatalocalfast.exe")) returned 1 [0063.003] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersnextadminappdatalocalfast.exe")) returned 1 [0063.003] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0063.004] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0063.004] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.005] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.005] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x318, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0063.006] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0063.006] Process32NextW (in: hSnapshot=0x1b8, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 0 [0063.007] CloseHandle (hObject=0x1b8) returned 1 [0063.007] Sleep (dwMilliseconds=0x1f4) [0063.691] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1bc [0063.695] Process32FirstW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0063.695] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0063.696] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0063.696] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.697] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0063.698] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.698] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0063.699] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0063.699] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0063.700] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0063.700] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.701] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.702] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.702] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.704] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.704] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0063.705] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.705] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.706] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0063.706] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0063.707] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0063.707] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.708] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0063.708] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0063.709] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="clock-drives.exe")) returned 1 [0063.710] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stanford_robots.exe")) returned 1 [0063.710] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0063.711] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="materials rules.exe")) returned 1 [0063.711] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pameladecimalinvasion.exe")) returned 1 [0063.712] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlock.exe")) returned 1 [0063.712] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reachsmartvirtue.exe")) returned 1 [0063.713] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="citation-ooo.exe")) returned 1 [0063.714] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmc_forest_closely.exe")) returned 1 [0063.714] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="realized_featured_doc.exe")) returned 1 [0063.715] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="instructorspeechthemes.exe")) returned 1 [0063.715] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wide thereafter details.exe")) returned 1 [0063.716] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="health_issued_laser.exe")) returned 1 [0063.716] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bite.exe")) returned 1 [0063.717] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pocket present.exe")) returned 1 [0063.717] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="asn.exe")) returned 1 [0063.718] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0063.718] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0063.719] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0063.719] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0063.720] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0063.720] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0063.721] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0063.721] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0063.722] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0063.722] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0063.723] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0063.723] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0063.724] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0063.724] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0063.725] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0063.725] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0063.726] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0063.726] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0065.811] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0065.812] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0065.813] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0065.814] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0065.815] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0065.816] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0065.817] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0065.818] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0065.819] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0065.820] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0065.821] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0065.822] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0065.823] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0065.824] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0065.825] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0065.826] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0065.827] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0065.828] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0065.829] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0065.830] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0065.831] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0065.831] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0065.832] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0065.833] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0065.834] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hotel-establish.exe")) returned 1 [0065.835] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ranges.exe")) returned 1 [0065.835] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0065.836] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0065.837] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0065.838] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersnextadminappdatalocalfast.exe")) returned 1 [0065.839] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersnextadminappdatalocalfast.exe")) returned 1 [0065.839] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0065.840] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0065.841] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0065.842] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0065.843] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x318, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0065.843] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0065.844] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0065.845] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0065.846] CloseHandle (hObject=0x1bc) returned 1 [0065.846] Sleep (dwMilliseconds=0x1f4) [0066.809] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1cc [0066.814] Process32FirstW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0066.814] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0066.818] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0066.819] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0066.820] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0066.821] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0066.821] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0066.822] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0066.823] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0066.823] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0066.824] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.825] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.825] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.826] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.827] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x33, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.827] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0066.828] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.828] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.829] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0066.829] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0066.830] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0066.830] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.831] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0066.831] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0066.832] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="clock-drives.exe")) returned 1 [0066.832] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stanford_robots.exe")) returned 1 [0066.833] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0066.833] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="materials rules.exe")) returned 1 [0066.834] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pameladecimalinvasion.exe")) returned 1 [0066.834] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlock.exe")) returned 1 [0066.835] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reachsmartvirtue.exe")) returned 1 [0066.835] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="citation-ooo.exe")) returned 1 [0066.836] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmc_forest_closely.exe")) returned 1 [0066.836] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="realized_featured_doc.exe")) returned 1 [0066.837] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="instructorspeechthemes.exe")) returned 1 [0066.837] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wide thereafter details.exe")) returned 1 [0066.838] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="health_issued_laser.exe")) returned 1 [0066.838] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bite.exe")) returned 1 [0066.839] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pocket present.exe")) returned 1 [0066.840] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="asn.exe")) returned 1 [0066.841] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0066.841] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0066.842] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0066.842] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0066.843] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0066.843] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0066.844] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0067.489] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0067.497] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0067.497] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0067.498] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0067.499] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0067.530] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0067.530] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0067.531] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0067.532] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0067.532] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0067.533] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0067.534] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0067.535] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0067.536] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0067.537] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0067.538] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0067.538] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0067.539] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0067.540] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0067.541] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0067.542] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0067.543] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0067.544] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0067.545] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0067.546] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0067.547] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0067.547] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0067.548] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0067.549] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0067.550] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0067.551] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0067.551] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0067.552] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0067.553] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0067.554] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0067.555] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hotel-establish.exe")) returned 1 [0067.556] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ranges.exe")) returned 1 [0068.033] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0068.034] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0068.035] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0068.035] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersnextadminappdatalocalfast.exe")) returned 1 [0068.036] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersnextadminappdatalocalfast.exe")) returned 1 [0068.036] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0068.037] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0068.038] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0068.038] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0068.039] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x318, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0068.039] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0068.040] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0068.041] Process32NextW (in: hSnapshot=0x1cc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0068.041] CloseHandle (hObject=0x1cc) returned 1 [0068.041] Sleep (dwMilliseconds=0x1f4) [0069.950] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1bc [0069.955] Process32FirstW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0069.956] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0069.956] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0069.957] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0069.958] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0069.958] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0069.959] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0069.960] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0069.961] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0069.961] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0069.962] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.963] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.963] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.964] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.964] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x33, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.965] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0069.966] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.966] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.967] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0069.968] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0069.968] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0069.969] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.970] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0069.970] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0069.971] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="clock-drives.exe")) returned 1 [0069.972] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="stanford_robots.exe")) returned 1 [0069.972] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0069.973] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="materials rules.exe")) returned 1 [0069.974] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pameladecimalinvasion.exe")) returned 1 [0069.974] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlock.exe")) returned 1 [0069.975] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="reachsmartvirtue.exe")) returned 1 [0069.976] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="citation-ooo.exe")) returned 1 [0069.976] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmc_forest_closely.exe")) returned 1 [0069.977] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="realized_featured_doc.exe")) returned 1 [0069.978] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="instructorspeechthemes.exe")) returned 1 [0069.978] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wide thereafter details.exe")) returned 1 [0069.979] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="health_issued_laser.exe")) returned 1 [0069.980] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bite.exe")) returned 1 [0069.980] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pocket present.exe")) returned 1 [0069.981] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="asn.exe")) returned 1 [0069.982] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0069.982] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0069.983] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0069.984] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0070.167] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0070.168] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0070.169] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0070.169] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0070.170] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0070.171] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0070.171] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0070.172] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0070.173] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0070.173] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0070.174] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0070.175] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0070.176] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0070.177] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0070.177] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0070.178] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0070.179] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0070.180] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0070.181] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0070.182] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0070.183] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0070.184] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0070.185] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0070.186] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0070.187] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0070.188] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0070.189] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0070.190] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0070.191] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0070.192] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0070.193] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0070.194] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0070.195] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0070.196] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0070.197] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0070.198] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0070.198] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0070.199] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0070.296] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hotel-establish.exe")) returned 1 [0070.296] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ranges.exe")) returned 1 [0070.297] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0070.298] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0070.299] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0070.300] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersnextadminappdatalocalfast.exe")) returned 1 [0070.301] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cusersnextadminappdatalocalfast.exe")) returned 1 [0070.302] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0070.303] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0070.303] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0070.304] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0070.305] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x318, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0070.306] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0070.307] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0070.308] Process32NextW (in: hSnapshot=0x1bc, lppe=0x104fc54 | out: lppe=0x104fc54*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0070.308] CloseHandle (hObject=0x1bc) returned 1 [0070.308] Sleep (dwMilliseconds=0x1f4) Thread: id = 14 os_tid = 0x418 [0045.282] GetVersion () returned 0x1db10106 [0045.282] GetCurrentProcess () returned 0xffffffff [0045.282] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x283fa4c | out: TokenHandle=0x283fa4c*=0x138) returned 1 [0045.282] GetTokenInformation (in: TokenHandle=0x138, TokenInformationClass=0x14, TokenInformation=0x283fa44, TokenInformationLength=0x4, ReturnLength=0x283fa48 | out: TokenInformation=0x283fa44, ReturnLength=0x283fa48) returned 1 [0045.283] CloseHandle (hObject=0x138) returned 1 [0045.283] GetProcessHeap () returned 0x350000 [0045.283] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20) returned 0x36a2d0 [0045.283] GetProcessHeap () returned 0x350000 [0045.283] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1e) returned 0x36a2a8 [0045.283] GetProcessHeap () returned 0x350000 [0045.283] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x1e) returned 0x36a3e8 [0045.283] GetProcessHeap () returned 0x350000 [0045.283] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x36a8f0 [0045.283] GetProcessHeap () returned 0x350000 [0045.283] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a8f0 | out: hHeap=0x350000) returned 1 [0045.283] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x36a2a8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0045.283] GetProcessHeap () returned 0x350000 [0045.283] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a3e8 | out: hHeap=0x350000) returned 1 [0045.283] GetProcessHeap () returned 0x350000 [0045.283] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a2d0 | out: hHeap=0x350000) returned 1 [0045.283] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283f9d4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283f9d4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0045.284] GetProcessHeap () returned 0x350000 [0045.284] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a2a8 | out: hHeap=0x350000) returned 1 [0045.284] GetProcessHeap () returned 0x350000 [0045.284] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x40) returned 0x364120 [0045.284] GetProcessHeap () returned 0x350000 [0045.284] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x3a) returned 0x364168 [0045.284] GetProcessHeap () returned 0x350000 [0045.284] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x364168, Size=0x72) returned 0x35f870 [0045.284] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x138 [0045.284] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x0) returned 0x102 [0045.284] CloseHandle (hObject=0x138) returned 1 [0045.284] GetProcessHeap () returned 0x350000 [0045.284] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x364120 | out: hHeap=0x350000) returned 1 [0045.284] GetProcessHeap () returned 0x350000 [0045.284] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x35f870 | out: hHeap=0x350000) returned 1 [0045.284] Sleep (dwMilliseconds=0x3e8) [0049.773] GetProcessHeap () returned 0x350000 [0049.773] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20) returned 0x36a5f0 [0049.773] GetProcessHeap () returned 0x350000 [0049.773] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1e) returned 0x36a618 [0049.773] GetProcessHeap () returned 0x350000 [0049.773] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x1e) returned 0x36a640 [0049.773] GetProcessHeap () returned 0x350000 [0049.773] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x3720e0 [0049.773] GetProcessHeap () returned 0x350000 [0049.773] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3720e0 | out: hHeap=0x350000) returned 1 [0049.773] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x36a618, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0049.774] GetProcessHeap () returned 0x350000 [0049.774] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a640 | out: hHeap=0x350000) returned 1 [0049.774] GetProcessHeap () returned 0x350000 [0049.774] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a5f0 | out: hHeap=0x350000) returned 1 [0049.774] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283f9d4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283f9d4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0049.774] GetProcessHeap () returned 0x350000 [0049.774] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a618 | out: hHeap=0x350000) returned 1 [0049.774] GetProcessHeap () returned 0x350000 [0049.774] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x40) returned 0x364048 [0049.774] GetProcessHeap () returned 0x350000 [0049.774] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x3a) returned 0x364090 [0049.774] GetProcessHeap () returned 0x350000 [0049.774] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x364090, Size=0x72) returned 0x35f8f0 [0049.775] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1b0 [0049.775] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x0) returned 0x102 [0049.775] CloseHandle (hObject=0x1b0) returned 1 [0049.775] GetProcessHeap () returned 0x350000 [0049.775] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x364048 | out: hHeap=0x350000) returned 1 [0049.775] GetProcessHeap () returned 0x350000 [0049.775] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x35f8f0 | out: hHeap=0x350000) returned 1 [0049.775] Sleep (dwMilliseconds=0x3e8) [0052.854] GetProcessHeap () returned 0x350000 [0052.854] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20) returned 0x36a668 [0052.854] GetProcessHeap () returned 0x350000 [0052.854] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1e) returned 0x36a690 [0052.854] GetProcessHeap () returned 0x350000 [0052.854] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x1e) returned 0x36a6b8 [0052.854] GetProcessHeap () returned 0x350000 [0052.854] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x3727c8 [0052.854] GetProcessHeap () returned 0x350000 [0052.855] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3727c8 | out: hHeap=0x350000) returned 1 [0052.855] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x36a690, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0052.855] GetProcessHeap () returned 0x350000 [0052.855] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a6b8 | out: hHeap=0x350000) returned 1 [0052.855] GetProcessHeap () returned 0x350000 [0052.855] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a668 | out: hHeap=0x350000) returned 1 [0052.855] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283f9d4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283f9d4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0052.856] GetProcessHeap () returned 0x350000 [0052.856] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a690 | out: hHeap=0x350000) returned 1 [0052.856] GetProcessHeap () returned 0x350000 [0052.856] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x40) returned 0x364048 [0052.856] GetProcessHeap () returned 0x350000 [0052.856] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x3a) returned 0x364090 [0052.856] GetProcessHeap () returned 0x350000 [0052.856] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x364090, Size=0x72) returned 0x35f8f0 [0052.856] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1bc [0052.856] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x0) returned 0x102 [0052.856] CloseHandle (hObject=0x1bc) returned 1 [0052.856] GetProcessHeap () returned 0x350000 [0052.856] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x364048 | out: hHeap=0x350000) returned 1 [0052.856] GetProcessHeap () returned 0x350000 [0052.856] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x35f8f0 | out: hHeap=0x350000) returned 1 [0052.857] Sleep (dwMilliseconds=0x3e8) [0054.097] GetProcessHeap () returned 0x350000 [0054.097] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20) returned 0x36a6b8 [0054.098] GetProcessHeap () returned 0x350000 [0054.098] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1e) returned 0x36a6e0 [0054.098] GetProcessHeap () returned 0x350000 [0054.098] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x1e) returned 0x3c65f0 [0054.098] GetProcessHeap () returned 0x350000 [0054.098] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x372860 [0054.098] GetProcessHeap () returned 0x350000 [0054.098] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x372860 | out: hHeap=0x350000) returned 1 [0054.098] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x36a6e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0054.098] GetProcessHeap () returned 0x350000 [0054.098] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3c65f0 | out: hHeap=0x350000) returned 1 [0054.098] GetProcessHeap () returned 0x350000 [0054.098] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a6b8 | out: hHeap=0x350000) returned 1 [0054.098] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283f9d4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283f9d4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0054.098] GetProcessHeap () returned 0x350000 [0054.098] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a6e0 | out: hHeap=0x350000) returned 1 [0054.098] GetProcessHeap () returned 0x350000 [0054.098] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x40) returned 0x364048 [0054.099] GetProcessHeap () returned 0x350000 [0054.099] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x3a) returned 0x364090 [0054.099] GetProcessHeap () returned 0x350000 [0054.099] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x364090, Size=0x72) returned 0x35f8f0 [0054.099] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1b8 [0054.099] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0x0) returned 0x102 [0054.099] CloseHandle (hObject=0x1b8) returned 1 [0054.099] GetProcessHeap () returned 0x350000 [0054.099] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x364048 | out: hHeap=0x350000) returned 1 [0054.099] GetProcessHeap () returned 0x350000 [0054.099] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x35f8f0 | out: hHeap=0x350000) returned 1 [0054.099] Sleep (dwMilliseconds=0x3e8) [0059.070] GetProcessHeap () returned 0x350000 [0059.070] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20) returned 0x36a6e0 [0059.070] GetProcessHeap () returned 0x350000 [0059.070] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1e) returned 0x36a6b8 [0059.070] GetProcessHeap () returned 0x350000 [0059.070] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x1e) returned 0x3c65f0 [0059.070] GetProcessHeap () returned 0x350000 [0059.070] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x372860 [0059.070] GetProcessHeap () returned 0x350000 [0059.070] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x372860 | out: hHeap=0x350000) returned 1 [0059.070] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x36a6b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0059.070] GetProcessHeap () returned 0x350000 [0059.070] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3c65f0 | out: hHeap=0x350000) returned 1 [0059.070] GetProcessHeap () returned 0x350000 [0059.070] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a6e0 | out: hHeap=0x350000) returned 1 [0059.070] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283f9d4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283f9d4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0059.071] GetProcessHeap () returned 0x350000 [0059.071] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a6b8 | out: hHeap=0x350000) returned 1 [0059.071] GetProcessHeap () returned 0x350000 [0059.071] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x40) returned 0x364048 [0059.071] GetProcessHeap () returned 0x350000 [0059.071] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x3a) returned 0x364090 [0059.071] GetProcessHeap () returned 0x350000 [0059.072] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x364090, Size=0x72) returned 0x35f8f0 [0059.072] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1b8 [0059.072] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0x0) returned 0x102 [0059.072] CloseHandle (hObject=0x1b8) returned 1 [0059.072] GetProcessHeap () returned 0x350000 [0059.072] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x364048 | out: hHeap=0x350000) returned 1 [0059.072] GetProcessHeap () returned 0x350000 [0059.072] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x35f8f0 | out: hHeap=0x350000) returned 1 [0059.073] Sleep (dwMilliseconds=0x3e8) [0060.787] GetProcessHeap () returned 0x350000 [0060.787] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20) returned 0x36a6b8 [0060.787] GetProcessHeap () returned 0x350000 [0060.787] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1e) returned 0x36a6e0 [0060.787] GetProcessHeap () returned 0x350000 [0060.787] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x1e) returned 0x3c65f0 [0060.787] GetProcessHeap () returned 0x350000 [0060.787] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x3727c8 [0060.787] GetProcessHeap () returned 0x350000 [0060.787] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3727c8 | out: hHeap=0x350000) returned 1 [0060.787] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x36a6e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0060.787] GetProcessHeap () returned 0x350000 [0060.787] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3c65f0 | out: hHeap=0x350000) returned 1 [0060.787] GetProcessHeap () returned 0x350000 [0060.787] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a6b8 | out: hHeap=0x350000) returned 1 [0060.787] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283f9d4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283f9d4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0060.788] GetProcessHeap () returned 0x350000 [0060.788] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a6e0 | out: hHeap=0x350000) returned 1 [0060.788] GetProcessHeap () returned 0x350000 [0060.788] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x40) returned 0x364048 [0060.788] GetProcessHeap () returned 0x350000 [0060.788] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x3a) returned 0x364090 [0060.788] GetProcessHeap () returned 0x350000 [0060.788] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x364090, Size=0x72) returned 0x35f870 [0060.788] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1b4 [0060.788] WaitForSingleObject (hHandle=0x1b4, dwMilliseconds=0x0) returned 0x102 [0060.788] CloseHandle (hObject=0x1b4) returned 1 [0060.788] GetProcessHeap () returned 0x350000 [0060.788] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x364048 | out: hHeap=0x350000) returned 1 [0060.788] GetProcessHeap () returned 0x350000 [0060.788] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x35f870 | out: hHeap=0x350000) returned 1 [0060.789] Sleep (dwMilliseconds=0x3e8) [0061.927] GetProcessHeap () returned 0x350000 [0061.927] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20) returned 0x36a6b8 [0061.927] GetProcessHeap () returned 0x350000 [0061.927] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1e) returned 0x3c65f0 [0061.927] GetProcessHeap () returned 0x350000 [0061.927] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x1e) returned 0x3c6618 [0061.927] GetProcessHeap () returned 0x350000 [0061.927] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x3727c8 [0061.927] GetProcessHeap () returned 0x350000 [0061.927] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3727c8 | out: hHeap=0x350000) returned 1 [0061.927] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3c65f0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0061.927] GetProcessHeap () returned 0x350000 [0061.927] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3c6618 | out: hHeap=0x350000) returned 1 [0061.927] GetProcessHeap () returned 0x350000 [0061.927] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a6b8 | out: hHeap=0x350000) returned 1 [0061.927] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283f9d4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283f9d4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0061.928] GetProcessHeap () returned 0x350000 [0061.928] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3c65f0 | out: hHeap=0x350000) returned 1 [0061.928] GetProcessHeap () returned 0x350000 [0061.928] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x40) returned 0x364048 [0061.928] GetProcessHeap () returned 0x350000 [0061.928] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x3a) returned 0x364090 [0061.928] GetProcessHeap () returned 0x350000 [0061.928] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x364090, Size=0x72) returned 0x35f8f0 [0061.928] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1cc [0061.928] WaitForSingleObject (hHandle=0x1cc, dwMilliseconds=0x0) returned 0x102 [0061.928] CloseHandle (hObject=0x1cc) returned 1 [0061.928] GetProcessHeap () returned 0x350000 [0061.928] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x364048 | out: hHeap=0x350000) returned 1 [0061.928] GetProcessHeap () returned 0x350000 [0061.928] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x35f8f0 | out: hHeap=0x350000) returned 1 [0061.928] Sleep (dwMilliseconds=0x3e8) [0063.048] GetProcessHeap () returned 0x350000 [0063.048] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20) returned 0x36a6b8 [0063.048] GetProcessHeap () returned 0x350000 [0063.048] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1e) returned 0x3c65f0 [0063.048] GetProcessHeap () returned 0x350000 [0063.048] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x1e) returned 0x3c6618 [0063.048] GetProcessHeap () returned 0x350000 [0063.048] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x3727c8 [0063.048] GetProcessHeap () returned 0x350000 [0063.048] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3727c8 | out: hHeap=0x350000) returned 1 [0063.048] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3c65f0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0063.048] GetProcessHeap () returned 0x350000 [0063.048] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3c6618 | out: hHeap=0x350000) returned 1 [0063.048] GetProcessHeap () returned 0x350000 [0063.048] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a6b8 | out: hHeap=0x350000) returned 1 [0063.048] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283f9d4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283f9d4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0063.049] GetProcessHeap () returned 0x350000 [0063.049] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3c65f0 | out: hHeap=0x350000) returned 1 [0063.049] GetProcessHeap () returned 0x350000 [0063.049] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x40) returned 0x364048 [0063.049] GetProcessHeap () returned 0x350000 [0063.049] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x3a) returned 0x364090 [0063.049] GetProcessHeap () returned 0x350000 [0063.049] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x364090, Size=0x72) returned 0x35f870 [0063.049] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1b8 [0063.049] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0x0) returned 0x102 [0063.049] CloseHandle (hObject=0x1b8) returned 1 [0063.049] GetProcessHeap () returned 0x350000 [0063.049] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x364048 | out: hHeap=0x350000) returned 1 [0063.049] GetProcessHeap () returned 0x350000 [0063.049] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x35f870 | out: hHeap=0x350000) returned 1 [0063.049] Sleep (dwMilliseconds=0x3e8) [0066.043] GetProcessHeap () returned 0x350000 [0066.043] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20) returned 0x36a6b8 [0066.043] GetProcessHeap () returned 0x350000 [0066.043] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1e) returned 0x3c65f0 [0066.044] GetProcessHeap () returned 0x350000 [0066.044] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x1e) returned 0x3c6618 [0066.044] GetProcessHeap () returned 0x350000 [0066.044] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x3727c8 [0066.044] GetProcessHeap () returned 0x350000 [0066.044] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3727c8 | out: hHeap=0x350000) returned 1 [0066.044] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3c65f0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0066.044] GetProcessHeap () returned 0x350000 [0066.044] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3c6618 | out: hHeap=0x350000) returned 1 [0066.044] GetProcessHeap () returned 0x350000 [0066.044] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a6b8 | out: hHeap=0x350000) returned 1 [0066.044] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283f9d4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283f9d4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0066.044] GetProcessHeap () returned 0x350000 [0066.044] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3c65f0 | out: hHeap=0x350000) returned 1 [0066.045] GetProcessHeap () returned 0x350000 [0066.045] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x40) returned 0x364048 [0066.045] GetProcessHeap () returned 0x350000 [0066.045] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x3a) returned 0x364090 [0066.045] GetProcessHeap () returned 0x350000 [0066.045] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x364090, Size=0x72) returned 0x35f870 [0066.045] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1cc [0066.045] WaitForSingleObject (hHandle=0x1cc, dwMilliseconds=0x0) returned 0x102 [0066.045] CloseHandle (hObject=0x1cc) returned 1 [0066.045] GetProcessHeap () returned 0x350000 [0066.045] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x364048 | out: hHeap=0x350000) returned 1 [0066.045] GetProcessHeap () returned 0x350000 [0066.045] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x35f870 | out: hHeap=0x350000) returned 1 [0066.045] Sleep (dwMilliseconds=0x3e8) [0069.095] GetProcessHeap () returned 0x350000 [0069.095] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20) returned 0x36a6b8 [0069.095] GetProcessHeap () returned 0x350000 [0069.095] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1e) returned 0x3c65f0 [0069.095] GetProcessHeap () returned 0x350000 [0069.095] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x1e) returned 0x3c6618 [0069.095] GetProcessHeap () returned 0x350000 [0069.095] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x3727c8 [0069.096] GetProcessHeap () returned 0x350000 [0069.096] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3727c8 | out: hHeap=0x350000) returned 1 [0069.096] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3c65f0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0069.096] GetProcessHeap () returned 0x350000 [0069.096] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3c6618 | out: hHeap=0x350000) returned 1 [0069.096] GetProcessHeap () returned 0x350000 [0069.096] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a6b8 | out: hHeap=0x350000) returned 1 [0069.096] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283f9d4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283f9d4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0069.096] GetProcessHeap () returned 0x350000 [0069.096] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3c65f0 | out: hHeap=0x350000) returned 1 [0069.096] GetProcessHeap () returned 0x350000 [0069.096] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x40) returned 0x364048 [0069.097] GetProcessHeap () returned 0x350000 [0069.097] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x3a) returned 0x364090 [0069.097] GetProcessHeap () returned 0x350000 [0069.097] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x364090, Size=0x72) returned 0x35f8f0 [0069.097] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1cc [0069.097] WaitForSingleObject (hHandle=0x1cc, dwMilliseconds=0x0) returned 0x102 [0069.097] CloseHandle (hObject=0x1cc) returned 1 [0069.097] GetProcessHeap () returned 0x350000 [0069.097] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x364048 | out: hHeap=0x350000) returned 1 [0069.097] GetProcessHeap () returned 0x350000 [0069.097] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x35f8f0 | out: hHeap=0x350000) returned 1 [0069.097] Sleep (dwMilliseconds=0x3e8) [0070.620] GetProcessHeap () returned 0x350000 [0070.620] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20) returned 0x36a6b8 [0070.620] GetProcessHeap () returned 0x350000 [0070.620] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1e) returned 0x3c65f0 [0070.620] GetProcessHeap () returned 0x350000 [0070.620] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x1e) returned 0x3c6618 [0070.620] GetProcessHeap () returned 0x350000 [0070.620] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x3727c8 [0070.621] GetProcessHeap () returned 0x350000 [0070.621] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3727c8 | out: hHeap=0x350000) returned 1 [0070.621] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3c65f0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0070.621] GetProcessHeap () returned 0x350000 [0070.621] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3c6618 | out: hHeap=0x350000) returned 1 [0070.621] GetProcessHeap () returned 0x350000 [0070.621] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a6b8 | out: hHeap=0x350000) returned 1 [0070.621] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283f9d4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283f9d4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0070.621] GetProcessHeap () returned 0x350000 [0070.621] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3c65f0 | out: hHeap=0x350000) returned 1 [0070.621] GetProcessHeap () returned 0x350000 [0070.621] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x40) returned 0x364048 [0070.621] GetProcessHeap () returned 0x350000 [0070.621] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x3a) returned 0x364090 [0070.621] GetProcessHeap () returned 0x350000 [0070.621] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x364090, Size=0x72) returned 0x35f870 [0070.621] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1bc [0070.621] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x0) returned 0x102 [0070.621] CloseHandle (hObject=0x1bc) returned 1 [0070.621] GetProcessHeap () returned 0x350000 [0070.621] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x364048 | out: hHeap=0x350000) returned 1 [0070.621] GetProcessHeap () returned 0x350000 [0070.621] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x35f870 | out: hHeap=0x350000) returned 1 [0070.622] Sleep (dwMilliseconds=0x3e8) Thread: id = 15 os_tid = 0x798 [0045.285] GetProcessHeap () returned 0x350000 [0045.285] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x21a) returned 0x374980 [0045.285] GetProcessHeap () returned 0x350000 [0045.285] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x28) returned 0x36e108 [0045.285] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x138 [0045.285] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x13c [0045.285] GetComputerNameW (in: lpBuffer=0x374990, nSize=0x299fb88 | out: lpBuffer="XDUWTFONO", nSize=0x299fb88) returned 1 [0045.286] GetProcessHeap () returned 0x350000 [0045.286] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x26) returned 0x371048 [0045.286] CloseHandle (hObject=0x13c) returned 1 [0045.286] CloseHandle (hObject=0x138) returned 1 [0045.286] GetProcessHeap () returned 0x350000 [0045.286] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e108 | out: hHeap=0x350000) returned 1 [0045.286] GetProcessHeap () returned 0x350000 [0045.286] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x371048 | out: hHeap=0x350000) returned 1 [0045.287] GetProcessHeap () returned 0x350000 [0045.287] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x374980 | out: hHeap=0x350000) returned 1 [0045.287] GetProcessHeap () returned 0x350000 [0045.287] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e228 | out: hHeap=0x350000) returned 1 Thread: id = 16 os_tid = 0x7c8 [0045.288] GetLogicalDrives () returned 0x4 [0045.288] GetProcessHeap () returned 0x350000 [0045.288] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x40) returned 0x364120 [0045.288] GetProcessHeap () returned 0x350000 [0045.288] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x28) returned 0x371048 [0045.288] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x138 [0045.288] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x13c [0045.288] GetProcessHeap () returned 0x350000 [0045.288] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20) returned 0x36a2a8 [0045.288] GetProcessHeap () returned 0x350000 [0045.288] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1e) returned 0x36a2d0 [0045.288] GetProcessHeap () returned 0x350000 [0045.288] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x1e) returned 0x36a3e8 [0045.288] GetProcessHeap () returned 0x350000 [0045.288] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x36a8f0 [0045.288] GetProcessHeap () returned 0x350000 [0045.288] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a8f0 | out: hHeap=0x350000) returned 1 [0045.288] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x36a2d0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0045.288] GetProcessHeap () returned 0x350000 [0045.288] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a3e8 | out: hHeap=0x350000) returned 1 [0045.288] GetProcessHeap () returned 0x350000 [0045.289] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a2a8 | out: hHeap=0x350000) returned 1 [0045.289] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x11cfbbc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x11cfbbc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0045.289] GetProcessHeap () returned 0x350000 [0045.289] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a2d0 | out: hHeap=0x350000) returned 1 [0045.289] GetProcessHeap () returned 0x350000 [0045.289] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36b938 [0045.289] GetProcessHeap () returned 0x350000 [0045.289] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36b950 [0045.289] GetProcessHeap () returned 0x350000 [0045.289] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36b920 [0045.289] GetProcessHeap () returned 0x350000 [0045.289] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x36a8f0 [0045.289] GetProcessHeap () returned 0x350000 [0045.289] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36b908 [0045.289] htonl (hostlong=0x9c354b42) returned 0x424b359c [0045.290] QueryPerformanceCounter (in: lpPerformanceCount=0x11cfab0 | out: lpPerformanceCount=0x11cfab0*=16529267263) returned 1 [0045.290] GetTickCount () returned 0x1145d2e [0045.290] GetCurrentProcessId () returned 0x3a4 [0045.290] GetCurrentThreadId () returned 0x7c8 [0045.290] GetLocalTime (in: lpSystemTime=0x11cfa98 | out: lpSystemTime=0x11cfa98*(wYear=0x7e4, wMonth=0x8, wDayOfWeek=0x3, wDay=0x13, wHour=0x17, wMinute=0x35, wSecond=0x4, wMilliseconds=0x170)) [0045.290] SystemTimeToFileTime (in: lpSystemTime=0x11cfa98, lpFileTime=0x11cfaa8 | out: lpFileTime=0x11cfaa8) returned 1 [0045.290] QueryPerformanceCounter (in: lpPerformanceCount=0x11cfab0 | out: lpPerformanceCount=0x11cfab0*=16529300786) returned 1 [0045.291] GetProcessHeap () returned 0x350000 [0045.291] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x28) returned 0x36e108 [0045.291] GetProcessHeap () returned 0x350000 [0045.291] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36b968 [0045.291] GetProcessHeap () returned 0x350000 [0045.291] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x4) returned 0x36aaf8 [0045.291] GetProcessHeap () returned 0x350000 [0045.291] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x14) returned 0x36e248 [0045.291] GetProcessHeap () returned 0x350000 [0045.291] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36b980 [0045.291] GetProcessHeap () returned 0x350000 [0045.291] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x80) returned 0x36a988 [0045.291] GetProcessHeap () returned 0x350000 [0045.291] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36b998 [0045.291] GetProcessHeap () returned 0x350000 [0045.291] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x82) returned 0x36b6e8 [0045.291] GetProcessHeap () returned 0x350000 [0045.291] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36b9b0 [0045.291] GetProcessHeap () returned 0x350000 [0045.292] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x4) returned 0x36e138 [0045.292] GetProcessHeap () returned 0x350000 [0045.292] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36b9c8 [0045.292] GetProcessHeap () returned 0x350000 [0045.292] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x80) returned 0x36b778 [0045.292] GetProcessHeap () returned 0x350000 [0045.292] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36b9e0 [0045.292] GetProcessHeap () returned 0x350000 [0045.292] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x2) returned 0x371078 [0045.292] GetProcessHeap () returned 0x350000 [0045.292] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x4) returned 0x36eaf8 [0045.292] GetProcessHeap () returned 0x350000 [0045.292] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36b9f8 [0045.292] GetProcessHeap () returned 0x350000 [0045.292] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x80) returned 0x36b800 [0045.292] GetProcessHeap () returned 0x350000 [0045.292] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36ba10 [0045.292] GetProcessHeap () returned 0x350000 [0045.292] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x4) returned 0x36eb08 [0045.292] GetProcessHeap () returned 0x350000 [0045.292] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x371078, Size=0x82) returned 0x374980 [0045.292] GetProcessHeap () returned 0x350000 [0045.292] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x36eb08, Size=0x100) returned 0x374a10 [0045.292] GetProcessHeap () returned 0x350000 [0045.292] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36ba28 [0045.292] GetProcessHeap () returned 0x350000 [0045.292] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x82) returned 0x374b18 [0045.293] GetProcessHeap () returned 0x350000 [0045.293] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36ba40 [0045.293] GetProcessHeap () returned 0x350000 [0045.293] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x82) returned 0x374ba8 [0045.293] GetProcessHeap () returned 0x350000 [0045.293] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x374980, Size=0x104) returned 0x374c38 [0045.293] GetProcessHeap () returned 0x350000 [0045.293] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x374a10, Size=0x200) returned 0x374d48 [0045.294] GetProcessHeap () returned 0x350000 [0045.294] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36eaf8 | out: hHeap=0x350000) returned 1 [0045.294] GetProcessHeap () returned 0x350000 [0045.294] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x374d48 | out: hHeap=0x350000) returned 1 [0045.294] GetProcessHeap () returned 0x350000 [0045.294] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ba10 | out: hHeap=0x350000) returned 1 [0045.294] GetProcessHeap () returned 0x350000 [0045.294] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b778 | out: hHeap=0x350000) returned 1 [0045.294] GetProcessHeap () returned 0x350000 [0045.294] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b9c8 | out: hHeap=0x350000) returned 1 [0045.294] GetProcessHeap () returned 0x350000 [0045.294] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b800 | out: hHeap=0x350000) returned 1 [0045.294] GetProcessHeap () returned 0x350000 [0045.294] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b9f8 | out: hHeap=0x350000) returned 1 [0045.294] GetProcessHeap () returned 0x350000 [0045.295] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x374c38 | out: hHeap=0x350000) returned 1 [0045.295] GetProcessHeap () returned 0x350000 [0045.295] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b9e0 | out: hHeap=0x350000) returned 1 [0045.295] GetProcessHeap () returned 0x350000 [0045.295] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x374b18 | out: hHeap=0x350000) returned 1 [0045.295] GetProcessHeap () returned 0x350000 [0045.295] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ba28 | out: hHeap=0x350000) returned 1 [0045.295] GetProcessHeap () returned 0x350000 [0045.295] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x374ba8 | out: hHeap=0x350000) returned 1 [0045.295] GetProcessHeap () returned 0x350000 [0045.295] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ba40 | out: hHeap=0x350000) returned 1 [0045.295] GetProcessHeap () returned 0x350000 [0045.295] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36aaf8 | out: hHeap=0x350000) returned 1 [0045.295] GetProcessHeap () returned 0x350000 [0045.295] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b968 | out: hHeap=0x350000) returned 1 [0045.295] GetProcessHeap () returned 0x350000 [0045.295] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b6e8 | out: hHeap=0x350000) returned 1 [0045.296] GetProcessHeap () returned 0x350000 [0045.296] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b998 | out: hHeap=0x350000) returned 1 [0045.296] GetProcessHeap () returned 0x350000 [0045.296] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a988 | out: hHeap=0x350000) returned 1 [0045.296] GetProcessHeap () returned 0x350000 [0045.296] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b980 | out: hHeap=0x350000) returned 1 [0045.296] GetProcessHeap () returned 0x350000 [0045.296] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e138 | out: hHeap=0x350000) returned 1 [0045.296] GetProcessHeap () returned 0x350000 [0045.296] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b9b0 | out: hHeap=0x350000) returned 1 [0045.296] GetProcessHeap () returned 0x350000 [0045.296] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e108 | out: hHeap=0x350000) returned 1 [0045.296] GetProcessHeap () returned 0x350000 [0045.296] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e248 | out: hHeap=0x350000) returned 1 [0045.296] GetProcessHeap () returned 0x350000 [0045.296] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0xa4) returned 0x36a988 [0045.296] GetProcessHeap () returned 0x350000 [0045.296] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b950 | out: hHeap=0x350000) returned 1 [0045.296] GetProcessHeap () returned 0x350000 [0045.296] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b920 | out: hHeap=0x350000) returned 1 [0045.296] GetProcessHeap () returned 0x350000 [0045.296] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a8f0 | out: hHeap=0x350000) returned 1 [0045.296] GetProcessHeap () returned 0x350000 [0045.297] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b908 | out: hHeap=0x350000) returned 1 [0045.297] GetProcessHeap () returned 0x350000 [0045.297] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b938 | out: hHeap=0x350000) returned 1 [0045.297] GetProcessHeap () returned 0x350000 [0045.297] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x18) returned 0x36e248 [0045.297] GetProcessHeap () returned 0x350000 [0045.297] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xe) returned 0x36b938 [0045.297] ResetEvent (hEvent=0x13c) returned 1 [0045.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12655a0, lpParameter=0x36e248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0045.300] CloseHandle (hObject=0x140) returned 1 [0045.300] GetProcessHeap () returned 0x350000 [0045.300] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36b908 [0045.300] GetProcessHeap () returned 0x350000 [0045.300] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36b920 [0045.301] GetProcessHeap () returned 0x350000 [0045.301] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36b950 [0045.301] GetProcessHeap () returned 0x350000 [0045.301] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x36a8f0 [0045.301] GetProcessHeap () returned 0x350000 [0045.301] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36b9b0 [0045.301] htonl (hostlong=0x9c354b42) returned 0x424b359c [0045.301] GetProcessHeap () returned 0x350000 [0045.301] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x28) returned 0x36e108 [0045.301] GetProcessHeap () returned 0x350000 [0045.301] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36b980 [0045.301] GetProcessHeap () returned 0x350000 [0045.301] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x4) returned 0x36aaf8 [0045.301] GetProcessHeap () returned 0x350000 [0045.301] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x14) returned 0x36e308 [0045.301] GetProcessHeap () returned 0x350000 [0045.301] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36b998 [0045.301] GetProcessHeap () returned 0x350000 [0045.301] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x80) returned 0x36b6e8 [0045.301] GetProcessHeap () returned 0x350000 [0045.301] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36b968 [0045.301] GetProcessHeap () returned 0x350000 [0045.301] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x82) returned 0x36b770 [0045.301] GetProcessHeap () returned 0x350000 [0045.301] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36ba40 [0045.301] GetProcessHeap () returned 0x350000 [0045.301] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x4) returned 0x36e138 [0045.302] GetProcessHeap () returned 0x350000 [0045.302] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36ba28 [0045.302] GetProcessHeap () returned 0x350000 [0045.302] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x80) returned 0x36b800 [0045.302] GetProcessHeap () returned 0x350000 [0045.302] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36b9e0 [0045.302] GetProcessHeap () returned 0x350000 [0045.302] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x2) returned 0x36aa68 [0045.302] GetProcessHeap () returned 0x350000 [0045.302] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x4) returned 0x371078 [0045.302] GetProcessHeap () returned 0x350000 [0045.302] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36b9f8 [0045.302] GetProcessHeap () returned 0x350000 [0045.302] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x80) returned 0x375f58 [0045.302] GetProcessHeap () returned 0x350000 [0045.302] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36b9c8 [0045.302] GetProcessHeap () returned 0x350000 [0045.302] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x4) returned 0x36eaf8 [0045.302] GetProcessHeap () returned 0x350000 [0045.302] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x36aa68, Size=0x82) returned 0x375fe0 [0045.302] GetProcessHeap () returned 0x350000 [0045.302] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x36eaf8, Size=0x100) returned 0x376070 [0045.303] GetProcessHeap () returned 0x350000 [0045.303] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36ba10 [0045.303] GetProcessHeap () returned 0x350000 [0045.303] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x82) returned 0x376178 [0045.303] GetProcessHeap () returned 0x350000 [0045.303] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10) returned 0x36ba58 [0045.303] GetProcessHeap () returned 0x350000 [0045.303] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x82) returned 0x376208 [0045.303] GetProcessHeap () returned 0x350000 [0045.303] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x375fe0, Size=0x104) returned 0x376298 [0045.303] GetProcessHeap () returned 0x350000 [0045.303] RtlReAllocateHeap (Heap=0x350000, Flags=0x0, Ptr=0x376070, Size=0x200) returned 0x3763a8 [0045.304] GetProcessHeap () returned 0x350000 [0045.304] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x371078 | out: hHeap=0x350000) returned 1 [0045.304] GetProcessHeap () returned 0x350000 [0045.304] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3763a8 | out: hHeap=0x350000) returned 1 [0045.304] GetProcessHeap () returned 0x350000 [0045.304] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b9c8 | out: hHeap=0x350000) returned 1 [0045.304] GetProcessHeap () returned 0x350000 [0045.304] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b800 | out: hHeap=0x350000) returned 1 [0045.304] GetProcessHeap () returned 0x350000 [0045.304] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ba28 | out: hHeap=0x350000) returned 1 [0045.304] GetProcessHeap () returned 0x350000 [0045.304] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x375f58 | out: hHeap=0x350000) returned 1 [0045.304] GetProcessHeap () returned 0x350000 [0045.304] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b9f8 | out: hHeap=0x350000) returned 1 [0045.305] GetProcessHeap () returned 0x350000 [0045.305] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x376298 | out: hHeap=0x350000) returned 1 [0045.305] GetProcessHeap () returned 0x350000 [0045.305] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b9e0 | out: hHeap=0x350000) returned 1 [0045.305] GetProcessHeap () returned 0x350000 [0045.305] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x376178 | out: hHeap=0x350000) returned 1 [0045.305] GetProcessHeap () returned 0x350000 [0045.305] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ba10 | out: hHeap=0x350000) returned 1 [0045.305] GetProcessHeap () returned 0x350000 [0045.305] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x376208 | out: hHeap=0x350000) returned 1 [0045.305] GetProcessHeap () returned 0x350000 [0045.305] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ba58 | out: hHeap=0x350000) returned 1 [0045.305] GetProcessHeap () returned 0x350000 [0045.305] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36aaf8 | out: hHeap=0x350000) returned 1 [0045.305] GetProcessHeap () returned 0x350000 [0045.305] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b980 | out: hHeap=0x350000) returned 1 [0045.305] GetProcessHeap () returned 0x350000 [0045.305] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b770 | out: hHeap=0x350000) returned 1 [0045.305] GetProcessHeap () returned 0x350000 [0045.305] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b968 | out: hHeap=0x350000) returned 1 [0045.305] GetProcessHeap () returned 0x350000 [0045.305] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b6e8 | out: hHeap=0x350000) returned 1 [0045.305] GetProcessHeap () returned 0x350000 [0045.305] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b998 | out: hHeap=0x350000) returned 1 [0045.305] GetProcessHeap () returned 0x350000 [0045.305] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e138 | out: hHeap=0x350000) returned 1 [0045.305] GetProcessHeap () returned 0x350000 [0045.305] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36ba40 | out: hHeap=0x350000) returned 1 [0045.305] GetProcessHeap () returned 0x350000 [0045.305] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e108 | out: hHeap=0x350000) returned 1 [0045.305] GetProcessHeap () returned 0x350000 [0045.305] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36e308 | out: hHeap=0x350000) returned 1 [0045.306] GetProcessHeap () returned 0x350000 [0045.306] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0xa4) returned 0x36b6e8 [0045.306] GetProcessHeap () returned 0x350000 [0045.306] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b920 | out: hHeap=0x350000) returned 1 [0045.306] GetProcessHeap () returned 0x350000 [0045.306] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b950 | out: hHeap=0x350000) returned 1 [0045.306] GetProcessHeap () returned 0x350000 [0045.306] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a8f0 | out: hHeap=0x350000) returned 1 [0045.306] GetProcessHeap () returned 0x350000 [0045.306] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b9b0 | out: hHeap=0x350000) returned 1 [0045.306] GetProcessHeap () returned 0x350000 [0045.306] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36b908 | out: hHeap=0x350000) returned 1 [0045.306] GetProcessHeap () returned 0x350000 [0045.306] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x18) returned 0x36e308 [0045.306] GetProcessHeap () returned 0x350000 [0045.306] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0xe) returned 0x36b908 [0045.306] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12655a0, lpParameter=0x36e308, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0045.307] CloseHandle (hObject=0x140) returned 1 [0045.308] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0xffffffff) Thread: id = 17 os_tid = 0x570 [0045.298] GetLogicalDrives () returned 0x4 [0045.298] GetProcessHeap () returned 0x350000 [0045.299] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x20) returned 0x36a2d0 [0045.299] GetProcessHeap () returned 0x350000 [0045.299] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x8, Size=0x1e) returned 0x36a2a8 [0045.299] GetProcessHeap () returned 0x350000 [0045.299] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x1e) returned 0x36a3e8 [0045.299] GetProcessHeap () returned 0x350000 [0045.299] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x90) returned 0x36a8f0 [0045.299] GetProcessHeap () returned 0x350000 [0045.299] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a8f0 | out: hHeap=0x350000) returned 1 [0045.299] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x36a2a8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0045.299] GetProcessHeap () returned 0x350000 [0045.299] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a3e8 | out: hHeap=0x350000) returned 1 [0045.299] GetProcessHeap () returned 0x350000 [0045.299] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a2d0 | out: hHeap=0x350000) returned 1 [0045.299] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2b3f79c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2b3f79c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0045.299] GetProcessHeap () returned 0x350000 [0045.299] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36a2a8 | out: hHeap=0x350000) returned 1 [0045.299] GetProcessHeap () returned 0x350000 [0045.300] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x40) returned 0x364168 [0045.300] GetProcessHeap () returned 0x350000 [0045.300] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x28) returned 0x36aa38 [0045.300] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x144 [0045.300] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x148 [0045.300] GetLogicalDrives () returned 0x4 [0045.300] Sleep (dwMilliseconds=0x3e8) [0049.801] GetLogicalDrives () returned 0x4 [0049.801] Sleep (dwMilliseconds=0x3e8) [0052.857] GetLogicalDrives () returned 0x4 [0052.857] Sleep (dwMilliseconds=0x3e8) [0054.099] GetLogicalDrives () returned 0x4 [0054.100] Sleep (dwMilliseconds=0x3e8) [0059.073] GetLogicalDrives () returned 0x4 [0059.073] Sleep (dwMilliseconds=0x3e8) [0060.789] GetLogicalDrives () returned 0x4 [0060.789] Sleep (dwMilliseconds=0x3e8) [0061.929] GetLogicalDrives () returned 0x4 [0061.929] Sleep (dwMilliseconds=0x3e8) [0063.049] GetLogicalDrives () returned 0x4 [0063.049] Sleep (dwMilliseconds=0x3e8) [0066.045] GetLogicalDrives () returned 0x4 [0066.046] Sleep (dwMilliseconds=0x3e8) [0069.097] GetLogicalDrives () returned 0x4 [0069.098] Sleep (dwMilliseconds=0x3e8) [0070.622] GetLogicalDrives () returned 0x4 [0070.622] Sleep (dwMilliseconds=0x3e8) Thread: id = 18 os_tid = 0x7e0 [0045.386] GetProcessHeap () returned 0x350000 [0045.386] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x38) returned 0x36b550 [0045.386] GetProcessHeap () returned 0x350000 [0045.386] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x18) returned 0x36e3c8 [0045.386] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x168 [0045.386] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x16c [0045.386] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x170 [0045.386] GetProcessHeap () returned 0x350000 [0045.386] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3755a8 [0045.388] GetProcessHeap () returned 0x350000 [0045.388] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3855b0 [0045.389] GetProcessHeap () returned 0x350000 [0045.389] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x50) returned 0x36f6d8 [0045.389] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0045.390] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0045.390] Wow64DisableWow64FsRedirection (in: OldValue=0x29ff8e4 | out: OldValue=0x29ff8e4*=0x0) returned 1 [0045.390] GetProcessHeap () returned 0x350000 [0045.390] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36f6d8 | out: hHeap=0x350000) returned 1 [0045.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x12653ac, lpParameter=0x29ff8ec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x174 [0045.391] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x12653ac, lpParameter=0x29ff8ec, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x178 [0045.393] GetProcessHeap () returned 0x350000 [0045.393] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3955b8 [0045.394] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x29ff660 | out: lpFindFileData=0x29ff660*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x370ae0 [0045.395] GetProcessHeap () returned 0x350000 [0045.395] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3a55c0 [0045.396] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3751b8 [0045.396] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.396] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0045.396] GetProcessHeap () returned 0x350000 [0045.396] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b65d0 [0045.397] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3751f8 [0045.397] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.398] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0045.398] SetEvent (hEvent=0x16c) returned 1 [0045.398] ResetEvent (hEvent=0x170) returned 1 [0045.398] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0045.398] FindClose (in: hFindFile=0x3751f8 | out: hFindFile=0x3751f8) returned 1 [0045.398] GetProcessHeap () returned 0x350000 [0045.398] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0045.398] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0045.398] FindClose (in: hFindFile=0x3751b8 | out: hFindFile=0x3751b8) returned 1 [0045.398] GetProcessHeap () returned 0x350000 [0045.398] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3a55c0 | out: hHeap=0x350000) returned 1 [0045.398] FindNextFileW (in: hFindFile=0x370ae0, lpFindFileData=0x29ff660 | out: lpFindFileData=0x29ff660*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0045.399] GetProcessHeap () returned 0x350000 [0045.399] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3a65c8 [0045.399] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3751b8 [0045.399] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.399] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0045.399] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x9098e7a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0045.400] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0045.400] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0045.400] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0045.400] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0045.400] GetProcessHeap () returned 0x350000 [0045.400] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b75d8 [0045.400] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3751f8 [0045.402] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.402] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0045.402] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0045.402] FindClose (in: hFindFile=0x3751f8 | out: hFindFile=0x3751f8) returned 1 [0045.403] GetProcessHeap () returned 0x350000 [0045.403] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b75d8 | out: hHeap=0x350000) returned 1 [0045.403] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0045.403] GetProcessHeap () returned 0x350000 [0045.403] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b75d8 [0045.403] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3751f8 [0045.403] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.403] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0045.403] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0045.404] FindClose (in: hFindFile=0x3751f8 | out: hFindFile=0x3751f8) returned 1 [0045.404] GetProcessHeap () returned 0x350000 [0045.404] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b75d8 | out: hHeap=0x350000) returned 1 [0045.404] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0045.404] GetProcessHeap () returned 0x350000 [0045.404] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b75d8 [0045.404] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3751f8 [0045.405] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.405] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0045.406] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0045.406] FindClose (in: hFindFile=0x3751f8 | out: hFindFile=0x3751f8) returned 1 [0045.406] GetProcessHeap () returned 0x350000 [0045.406] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b75d8 | out: hHeap=0x350000) returned 1 [0045.406] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0045.406] GetProcessHeap () returned 0x350000 [0045.406] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b75d8 [0045.406] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3751f8 [0045.407] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.407] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0045.407] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0045.407] FindClose (in: hFindFile=0x3751f8 | out: hFindFile=0x3751f8) returned 1 [0045.407] GetProcessHeap () returned 0x350000 [0045.407] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b75d8 | out: hHeap=0x350000) returned 1 [0045.407] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0045.407] GetProcessHeap () returned 0x350000 [0045.408] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b75d8 [0045.408] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3751f8 [0045.409] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.409] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0045.409] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0045.409] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0045.409] FindClose (in: hFindFile=0x3751f8 | out: hFindFile=0x3751f8) returned 1 [0045.409] GetProcessHeap () returned 0x350000 [0045.409] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b75d8 | out: hHeap=0x350000) returned 1 [0045.410] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0045.410] GetProcessHeap () returned 0x350000 [0045.410] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b75d8 [0045.410] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3751f8 [0045.411] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.411] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0045.411] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0045.411] FindClose (in: hFindFile=0x3751f8 | out: hFindFile=0x3751f8) returned 1 [0045.411] GetProcessHeap () returned 0x350000 [0045.411] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b75d8 | out: hHeap=0x350000) returned 1 [0045.411] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0045.412] GetProcessHeap () returned 0x350000 [0045.412] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b75d8 [0045.412] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3751f8 [0045.412] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.412] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0045.413] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0045.413] FindClose (in: hFindFile=0x3751f8 | out: hFindFile=0x3751f8) returned 1 [0045.413] GetProcessHeap () returned 0x350000 [0045.413] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b75d8 | out: hHeap=0x350000) returned 1 [0045.413] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0045.413] GetProcessHeap () returned 0x350000 [0045.413] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b75d8 [0045.413] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3751f8 [0045.414] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.414] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0045.415] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0045.415] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0045.415] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0045.415] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0045.416] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0045.416] FindClose (in: hFindFile=0x3751f8 | out: hFindFile=0x3751f8) returned 1 [0045.416] GetProcessHeap () returned 0x350000 [0045.416] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b75d8 | out: hHeap=0x350000) returned 1 [0045.416] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0045.416] GetProcessHeap () returned 0x350000 [0045.416] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b75d8 [0045.417] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3751f8 [0045.418] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.418] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0045.418] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0045.418] FindClose (in: hFindFile=0x3751f8 | out: hFindFile=0x3751f8) returned 1 [0045.418] GetProcessHeap () returned 0x350000 [0045.418] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b75d8 | out: hHeap=0x350000) returned 1 [0045.418] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0045.418] GetProcessHeap () returned 0x350000 [0045.418] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b75d8 [0045.418] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3751f8 [0045.419] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.419] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0045.419] FindNextFileW (in: hFindFile=0x3751f8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0045.420] FindClose (in: hFindFile=0x3751f8 | out: hFindFile=0x3751f8) returned 1 [0045.424] GetProcessHeap () returned 0x350000 [0045.424] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b75d8 | out: hHeap=0x350000) returned 1 [0045.424] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0045.424] GetProcessHeap () returned 0x350000 [0045.425] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b75d8 [0045.425] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x371ff8 [0049.149] FindNextFileW (in: hFindFile=0x371ff8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.149] FindNextFileW (in: hFindFile=0x371ff8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.150] FindNextFileW (in: hFindFile=0x371ff8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.150] FindClose (in: hFindFile=0x371ff8 | out: hFindFile=0x371ff8) returned 1 [0049.150] GetProcessHeap () returned 0x350000 [0049.150] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b75d8 | out: hHeap=0x350000) returned 1 [0049.150] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0049.150] GetProcessHeap () returned 0x350000 [0049.150] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b75d8 [0049.150] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x371ff8 [0049.150] FindNextFileW (in: hFindFile=0x371ff8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.150] FindNextFileW (in: hFindFile=0x371ff8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.151] FindNextFileW (in: hFindFile=0x371ff8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.151] FindClose (in: hFindFile=0x371ff8 | out: hFindFile=0x371ff8) returned 1 [0049.151] GetProcessHeap () returned 0x350000 [0049.151] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b75d8 | out: hHeap=0x350000) returned 1 [0049.151] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0049.151] GetProcessHeap () returned 0x350000 [0049.151] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b75d8 [0049.151] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x371ff8 [0049.152] FindNextFileW (in: hFindFile=0x371ff8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.152] FindNextFileW (in: hFindFile=0x371ff8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.152] FindNextFileW (in: hFindFile=0x371ff8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.152] FindClose (in: hFindFile=0x371ff8 | out: hFindFile=0x371ff8) returned 1 [0049.152] GetProcessHeap () returned 0x350000 [0049.152] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b75d8 | out: hHeap=0x350000) returned 1 [0049.152] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0049.152] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0049.153] GetProcessHeap () returned 0x350000 [0049.153] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b75d8 [0049.153] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x371ff8 [0049.153] FindNextFileW (in: hFindFile=0x371ff8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.153] FindNextFileW (in: hFindFile=0x371ff8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.153] FindNextFileW (in: hFindFile=0x371ff8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.153] FindClose (in: hFindFile=0x371ff8 | out: hFindFile=0x371ff8) returned 1 [0049.153] GetProcessHeap () returned 0x350000 [0049.153] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b75d8 | out: hHeap=0x350000) returned 1 [0049.154] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0049.154] GetProcessHeap () returned 0x350000 [0049.154] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b75d8 [0049.154] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x371ff8 [0049.155] FindNextFileW (in: hFindFile=0x371ff8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.155] FindNextFileW (in: hFindFile=0x371ff8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.155] FindNextFileW (in: hFindFile=0x371ff8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.155] FindClose (in: hFindFile=0x371ff8 | out: hFindFile=0x371ff8) returned 1 [0049.155] GetProcessHeap () returned 0x350000 [0049.155] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b75d8 | out: hHeap=0x350000) returned 1 [0049.155] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0049.155] GetProcessHeap () returned 0x350000 [0049.155] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b75d8 [0049.155] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x371ff8 [0049.156] FindNextFileW (in: hFindFile=0x371ff8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.156] FindNextFileW (in: hFindFile=0x371ff8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.156] FindNextFileW (in: hFindFile=0x371ff8, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.156] FindClose (in: hFindFile=0x371ff8 | out: hFindFile=0x371ff8) returned 1 [0049.156] GetProcessHeap () returned 0x350000 [0049.156] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b75d8 | out: hHeap=0x350000) returned 1 [0049.156] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0049.157] GetProcessHeap () returned 0x350000 [0049.157] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b75d8 [0049.157] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x372008 [0049.158] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.158] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.158] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.158] FindClose (in: hFindFile=0x372008 | out: hFindFile=0x372008) returned 1 [0049.158] GetProcessHeap () returned 0x350000 [0049.158] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b75d8 | out: hHeap=0x350000) returned 1 [0049.158] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0049.159] GetProcessHeap () returned 0x350000 [0049.159] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b75d8 [0049.159] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x372008 [0049.159] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.159] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.159] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.159] FindClose (in: hFindFile=0x372008 | out: hFindFile=0x372008) returned 1 [0049.159] GetProcessHeap () returned 0x350000 [0049.159] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b75d8 | out: hHeap=0x350000) returned 1 [0049.160] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0049.160] GetProcessHeap () returned 0x350000 [0049.160] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b75d8 [0049.160] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x372008 [0049.161] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.161] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.161] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.161] FindClose (in: hFindFile=0x372008 | out: hFindFile=0x372008) returned 1 [0049.162] GetProcessHeap () returned 0x350000 [0049.162] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b75d8 | out: hHeap=0x350000) returned 1 [0049.162] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0049.162] GetProcessHeap () returned 0x350000 [0049.162] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b75d8 [0049.162] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x372008 [0049.162] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.162] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.163] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.163] FindClose (in: hFindFile=0x372008 | out: hFindFile=0x372008) returned 1 [0049.163] GetProcessHeap () returned 0x350000 [0049.163] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b75d8 | out: hHeap=0x350000) returned 1 [0049.163] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0049.163] GetProcessHeap () returned 0x350000 [0049.163] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b75d8 [0049.163] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x372008 [0049.164] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.164] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.164] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.164] FindClose (in: hFindFile=0x372008 | out: hFindFile=0x372008) returned 1 [0049.165] GetProcessHeap () returned 0x350000 [0049.165] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b75d8 | out: hHeap=0x350000) returned 1 [0049.165] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0049.165] GetProcessHeap () returned 0x350000 [0049.165] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b75d8 [0049.165] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x372008 [0049.165] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.165] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.165] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.165] FindClose (in: hFindFile=0x372008 | out: hFindFile=0x372008) returned 1 [0049.166] GetProcessHeap () returned 0x350000 [0049.166] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b75d8 | out: hHeap=0x350000) returned 1 [0049.166] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0049.166] GetProcessHeap () returned 0x350000 [0049.166] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b75d8 [0049.166] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x372008 [0049.167] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.167] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.167] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.167] FindClose (in: hFindFile=0x372008 | out: hFindFile=0x372008) returned 1 [0049.167] GetProcessHeap () returned 0x350000 [0049.167] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b75d8 | out: hHeap=0x350000) returned 1 [0049.167] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0049.167] GetProcessHeap () returned 0x350000 [0049.168] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b75d8 [0049.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x372008 [0049.168] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.168] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.168] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.168] FindClose (in: hFindFile=0x372008 | out: hFindFile=0x372008) returned 1 [0049.168] GetProcessHeap () returned 0x350000 [0049.168] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b75d8 | out: hHeap=0x350000) returned 1 [0049.168] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0049.168] FindClose (in: hFindFile=0x3751b8 | out: hFindFile=0x3751b8) returned 1 [0049.169] GetProcessHeap () returned 0x350000 [0049.169] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3a65c8 | out: hHeap=0x350000) returned 1 [0049.169] FindNextFileW (in: hFindFile=0x370ae0, lpFindFileData=0x29ff660 | out: lpFindFileData=0x29ff660*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0049.169] FindNextFileW (in: hFindFile=0x370ae0, lpFindFileData=0x29ff660 | out: lpFindFileData=0x29ff660*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0049.169] FindNextFileW (in: hFindFile=0x370ae0, lpFindFileData=0x29ff660 | out: lpFindFileData=0x29ff660*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0049.169] GetProcessHeap () returned 0x350000 [0049.169] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3a65c8 [0049.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Config.Msi\\*", lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3751b8 [0049.170] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.170] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0049.170] FindClose (in: hFindFile=0x3751b8 | out: hFindFile=0x3751b8) returned 1 [0049.170] GetProcessHeap () returned 0x350000 [0049.170] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3a65c8 | out: hHeap=0x350000) returned 1 [0049.170] FindNextFileW (in: hFindFile=0x370ae0, lpFindFileData=0x29ff660 | out: lpFindFileData=0x29ff660*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0049.170] FindNextFileW (in: hFindFile=0x370ae0, lpFindFileData=0x29ff660 | out: lpFindFileData=0x29ff660*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0049.170] FindNextFileW (in: hFindFile=0x370ae0, lpFindFileData=0x29ff660 | out: lpFindFileData=0x29ff660*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0049.170] GetProcessHeap () returned 0x350000 [0049.170] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3a65c8 [0049.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\*", lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3751b8 [0049.171] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.171] FindNextFileW (in: hFindFile=0x3751b8, lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0049.171] GetProcessHeap () returned 0x350000 [0049.171] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b65d0 [0049.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x372008 [0049.175] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.176] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0049.176] GetProcessHeap () returned 0x350000 [0049.176] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3412080 [0049.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x372048 [0049.177] FindNextFileW (in: hFindFile=0x372048, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.177] FindNextFileW (in: hFindFile=0x372048, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0049.178] FindNextFileW (in: hFindFile=0x372048, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0049.178] FindNextFileW (in: hFindFile=0x372048, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0049.178] FindNextFileW (in: hFindFile=0x372048, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.178] FindNextFileW (in: hFindFile=0x372048, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0049.178] FindClose (in: hFindFile=0x372048 | out: hFindFile=0x372048) returned 1 [0049.178] GetProcessHeap () returned 0x350000 [0049.178] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3412080 | out: hHeap=0x350000) returned 1 [0049.178] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0049.178] GetProcessHeap () returned 0x350000 [0049.178] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3412080 [0049.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34220a0 [0049.181] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.181] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0049.181] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0049.182] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0049.182] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.182] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0049.182] FindClose (in: hFindFile=0x34220a0 | out: hFindFile=0x34220a0) returned 1 [0049.183] GetProcessHeap () returned 0x350000 [0049.183] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3412080 | out: hHeap=0x350000) returned 1 [0049.183] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0049.183] GetProcessHeap () returned 0x350000 [0049.183] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3412080 [0049.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422120 [0049.441] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.605] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0049.605] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0049.605] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0049.606] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.606] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0049.606] FindClose (in: hFindFile=0x3422120 | out: hFindFile=0x3422120) returned 1 [0049.607] GetProcessHeap () returned 0x350000 [0049.607] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3412080 | out: hHeap=0x350000) returned 1 [0049.607] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0049.607] GetProcessHeap () returned 0x350000 [0049.607] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3412080 [0049.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422120 [0049.608] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.611] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0049.611] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0049.611] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0049.611] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.611] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0049.612] FindClose (in: hFindFile=0x3422120 | out: hFindFile=0x3422120) returned 1 [0049.613] GetProcessHeap () returned 0x350000 [0049.613] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3412080 | out: hHeap=0x350000) returned 1 [0049.613] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0049.613] GetProcessHeap () returned 0x350000 [0049.613] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3412080 [0049.613] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422120 [0049.613] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.613] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.614] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0049.614] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0049.614] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0049.614] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0049.614] FindClose (in: hFindFile=0x3422120 | out: hFindFile=0x3422120) returned 1 [0049.614] GetProcessHeap () returned 0x350000 [0049.614] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3412080 | out: hHeap=0x350000) returned 1 [0049.614] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0049.615] GetProcessHeap () returned 0x350000 [0049.615] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3412080 [0049.615] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422120 [0049.615] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.615] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0049.615] GetProcessHeap () returned 0x350000 [0049.615] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3456098 [0049.615] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422160 [0049.615] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.616] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0049.616] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0049.616] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0049.616] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0049.617] FindClose (in: hFindFile=0x3422160 | out: hFindFile=0x3422160) returned 1 [0049.617] GetProcessHeap () returned 0x350000 [0049.617] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3456098 | out: hHeap=0x350000) returned 1 [0049.617] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0049.617] GetProcessHeap () returned 0x350000 [0049.617] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3456098 [0049.617] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422160 [0049.617] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.617] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0049.617] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0049.617] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0049.618] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0049.618] FindClose (in: hFindFile=0x3422160 | out: hFindFile=0x3422160) returned 1 [0049.618] GetProcessHeap () returned 0x350000 [0049.618] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3456098 | out: hHeap=0x350000) returned 1 [0049.618] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0049.618] GetProcessHeap () returned 0x350000 [0049.618] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3456098 [0049.618] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422160 [0049.618] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.618] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0049.618] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0049.619] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0049.619] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0049.619] FindClose (in: hFindFile=0x3422160 | out: hFindFile=0x3422160) returned 1 [0049.619] GetProcessHeap () returned 0x350000 [0049.619] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3456098 | out: hHeap=0x350000) returned 1 [0049.619] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0049.619] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0049.619] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.620] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0049.620] FindClose (in: hFindFile=0x3422120 | out: hFindFile=0x3422120) returned 1 [0049.620] GetProcessHeap () returned 0x350000 [0049.620] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3412080 | out: hHeap=0x350000) returned 1 [0049.620] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0049.620] GetProcessHeap () returned 0x350000 [0049.620] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3412080 [0049.620] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422120 [0049.631] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.631] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0049.631] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0049.631] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0049.631] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.631] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0049.631] FindClose (in: hFindFile=0x3422120 | out: hFindFile=0x3422120) returned 1 [0049.632] GetProcessHeap () returned 0x350000 [0049.632] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3412080 | out: hHeap=0x350000) returned 1 [0049.633] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0049.633] GetProcessHeap () returned 0x350000 [0049.633] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3412080 [0049.633] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422120 [0049.635] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.635] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0049.635] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0049.635] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0049.635] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.635] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0049.635] FindClose (in: hFindFile=0x3422120 | out: hFindFile=0x3422120) returned 1 [0049.636] GetProcessHeap () returned 0x350000 [0049.636] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3412080 | out: hHeap=0x350000) returned 1 [0049.636] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0049.637] GetProcessHeap () returned 0x350000 [0049.637] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3412080 [0049.637] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422120 [0049.637] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.637] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.637] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0049.637] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0049.637] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0049.638] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0049.638] FindClose (in: hFindFile=0x3422120 | out: hFindFile=0x3422120) returned 1 [0049.638] GetProcessHeap () returned 0x350000 [0049.638] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3412080 | out: hHeap=0x350000) returned 1 [0049.638] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0049.638] GetProcessHeap () returned 0x350000 [0049.638] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3412080 [0049.638] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422120 [0049.641] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.641] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0049.641] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0049.641] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0049.641] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.642] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0049.642] FindClose (in: hFindFile=0x3422120 | out: hFindFile=0x3422120) returned 1 [0049.643] GetProcessHeap () returned 0x350000 [0049.643] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3412080 | out: hHeap=0x350000) returned 1 [0049.643] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0049.643] GetProcessHeap () returned 0x350000 [0049.643] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3412080 [0049.643] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422120 [0049.646] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.646] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0049.646] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0049.647] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0049.647] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.647] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0049.647] FindClose (in: hFindFile=0x3422120 | out: hFindFile=0x3422120) returned 1 [0049.840] GetProcessHeap () returned 0x350000 [0049.855] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3412080 | out: hHeap=0x350000) returned 1 [0049.855] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0049.855] GetProcessHeap () returned 0x350000 [0049.855] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3412080 [0049.855] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422120 [0049.856] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.857] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0049.857] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0049.857] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0049.858] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.858] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0049.858] FindClose (in: hFindFile=0x3422120 | out: hFindFile=0x3422120) returned 1 [0049.859] GetProcessHeap () returned 0x350000 [0049.859] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3412080 | out: hHeap=0x350000) returned 1 [0049.859] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0049.860] GetProcessHeap () returned 0x350000 [0049.860] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3412080 [0049.860] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422120 [0049.860] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.860] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0049.860] GetProcessHeap () returned 0x350000 [0049.860] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3456098 [0049.861] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422160 [0049.861] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.861] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0049.861] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0049.861] FindClose (in: hFindFile=0x3422160 | out: hFindFile=0x3422160) returned 1 [0049.862] GetProcessHeap () returned 0x350000 [0049.862] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3456098 | out: hHeap=0x350000) returned 1 [0049.862] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0049.862] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0049.862] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0049.863] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0049.863] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0049.863] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0049.864] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0049.864] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0049.865] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0049.865] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0049.865] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0049.866] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0049.866] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0049.866] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0049.867] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.867] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0049.867] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0 [0049.867] FindClose (in: hFindFile=0x3422120 | out: hFindFile=0x3422120) returned 1 [0049.868] GetProcessHeap () returned 0x350000 [0049.868] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3412080 | out: hHeap=0x350000) returned 1 [0049.868] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0049.868] GetProcessHeap () returned 0x350000 [0049.868] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3412080 [0049.868] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422120 [0049.990] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.990] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0049.991] GetProcessHeap () returned 0x350000 [0049.991] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3456098 [0049.991] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34221a0 [0050.093] FindNextFileW (in: hFindFile=0x34221a0, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.094] FindNextFileW (in: hFindFile=0x34221a0, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0050.094] FindNextFileW (in: hFindFile=0x34221a0, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0050.094] FindNextFileW (in: hFindFile=0x34221a0, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0050.094] FindNextFileW (in: hFindFile=0x34221a0, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0050.094] FindNextFileW (in: hFindFile=0x34221a0, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 0 [0050.094] FindClose (in: hFindFile=0x34221a0 | out: hFindFile=0x34221a0) returned 1 [0050.095] GetProcessHeap () returned 0x350000 [0050.095] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3456098 | out: hHeap=0x350000) returned 1 [0050.095] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0050.096] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0050.096] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0050.096] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0050.096] FindClose (in: hFindFile=0x3422120 | out: hFindFile=0x3422120) returned 1 [0050.096] GetProcessHeap () returned 0x350000 [0050.096] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3412080 | out: hHeap=0x350000) returned 1 [0050.096] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~1")) returned 1 [0050.096] GetProcessHeap () returned 0x350000 [0050.096] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3412080 [0050.096] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422120 [0050.099] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.099] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0050.099] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0050.099] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0050.100] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0050.100] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0050.100] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0050.100] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0050.100] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.msi", cAlternateFileName="PROPLU~1.MSI")) returned 1 [0050.100] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 1 [0050.100] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW.cab", cAlternateFileName="")) returned 1 [0050.101] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW2.cab", cAlternateFileName="")) returned 1 [0050.101] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0050.101] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0050.101] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0050.101] FindClose (in: hFindFile=0x3422120 | out: hFindFile=0x3422120) returned 1 [0050.102] GetProcessHeap () returned 0x350000 [0050.102] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3412080 | out: hHeap=0x350000) returned 1 [0050.102] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0050.102] GetProcessHeap () returned 0x350000 [0050.102] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3412080 [0050.102] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422120 [0050.105] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.105] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0050.105] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0050.105] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0050.105] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0050.105] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0050.105] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0050.105] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0050.106] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.msi", cAlternateFileName="PRJPRO~1.MSI")) returned 1 [0050.106] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.xml", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0050.106] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjPrrWW.cab", cAlternateFileName="")) returned 1 [0050.106] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0050.106] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0050.106] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0050.106] FindClose (in: hFindFile=0x3422120 | out: hFindFile=0x3422120) returned 1 [0050.107] GetProcessHeap () returned 0x350000 [0050.107] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3412080 | out: hHeap=0x350000) returned 1 [0050.107] FindNextFileW (in: hFindFile=0x372008, lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0050.107] GetProcessHeap () returned 0x350000 [0050.107] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3412080 [0050.107] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422120 [0050.110] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.110] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0050.110] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0050.110] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0050.110] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0050.111] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0050.111] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0050.111] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0050.111] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0050.111] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0050.111] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.cab", cAlternateFileName="")) returned 1 [0050.111] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.msi", cAlternateFileName="")) returned 1 [0050.112] FindClose (in: hFindFile=0x3422120 | out: hFindFile=0x3422120) returned 1 [0050.113] GetProcessHeap () returned 0x350000 [0050.113] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3412080 | out: hHeap=0x350000) returned 1 [0050.113] FindClose (in: hFindFile=0x372008 | out: hFindFile=0x372008) returned 1 [0050.113] GetProcessHeap () returned 0x350000 [0050.113] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0050.113] FindClose (in: hFindFile=0x3751b8 | out: hFindFile=0x3751b8) returned 1 [0050.115] GetProcessHeap () returned 0x350000 [0050.115] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3a65c8 | out: hHeap=0x350000) returned 1 [0050.116] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3411078 [0050.116] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422120 [0050.117] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\Admin\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34221a0 [0050.118] FindClose (in: hFindFile=0x34221a0 | out: hFindFile=0x34221a0) returned 1 [0050.118] GetProcessHeap () returned 0x350000 [0050.118] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3456098 | out: hHeap=0x350000) returned 1 [0050.118] FindClose (in: hFindFile=0x3422120 | out: hFindFile=0x3422120) returned 1 [0050.118] GetProcessHeap () returned 0x350000 [0050.118] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3411078 | out: hHeap=0x350000) returned 1 [0050.118] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x29ff3d8 | out: lpFindFileData=0x29ff3d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe20d0440, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe20d0440, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422120 [0050.118] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x29ff150 | out: lpFindFileData=0x29ff150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdc08eaa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc08eaa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34221a0 [0050.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34221e0 [0050.119] FindClose (in: hFindFile=0x34221e0 | out: hFindFile=0x34221e0) returned 1 [0050.119] GetProcessHeap () returned 0x350000 [0050.119] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3a65c8 | out: hHeap=0x350000) returned 1 [0050.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*", lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34221e0 [0050.120] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422220 [0050.121] FindClose (in: hFindFile=0x3422220 | out: hFindFile=0x3422220) returned 1 [0050.121] GetProcessHeap () returned 0x350000 [0050.121] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0050.121] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422220 [0050.123] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0050.124] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0050.124] GetProcessHeap () returned 0x350000 [0050.124] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0050.124] FindClose (in: hFindFile=0x3422220 | out: hFindFile=0x3422220) returned 1 [0050.124] GetProcessHeap () returned 0x350000 [0050.124] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0050.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422220 [0050.241] FindClose (in: hFindFile=0x3422220 | out: hFindFile=0x3422220) returned 1 [0050.241] GetProcessHeap () returned 0x350000 [0050.241] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0050.242] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422220 [0050.242] FindClose (in: hFindFile=0x3422220 | out: hFindFile=0x3422220) returned 1 [0050.242] GetProcessHeap () returned 0x350000 [0050.242] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34760a8 | out: hHeap=0x350000) returned 1 [0050.242] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422220 [0050.335] FindClose (in: hFindFile=0x3422220 | out: hFindFile=0x3422220) returned 1 [0050.335] GetProcessHeap () returned 0x350000 [0050.335] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34760a8 | out: hHeap=0x350000) returned 1 [0050.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422220 [0050.335] FindClose (in: hFindFile=0x3422220 | out: hFindFile=0x3422220) returned 1 [0050.335] GetProcessHeap () returned 0x350000 [0050.335] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34760a8 | out: hHeap=0x350000) returned 1 [0050.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422220 [0050.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0050.337] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0050.337] GetProcessHeap () returned 0x350000 [0050.337] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0050.337] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0050.338] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0050.338] GetProcessHeap () returned 0x350000 [0050.338] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0050.338] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0050.339] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0050.339] GetProcessHeap () returned 0x350000 [0050.339] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0050.339] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0050.339] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0050.339] GetProcessHeap () returned 0x350000 [0050.340] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0050.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0050.341] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0050.341] GetProcessHeap () returned 0x350000 [0050.341] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0050.341] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0050.342] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0050.342] GetProcessHeap () returned 0x350000 [0050.342] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0050.342] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0050.345] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0050.346] GetProcessHeap () returned 0x350000 [0050.346] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0050.346] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0050.347] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0050.347] GetProcessHeap () returned 0x350000 [0050.347] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0050.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0050.348] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0050.348] GetProcessHeap () returned 0x350000 [0050.349] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0050.349] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0050.349] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0050.349] GetProcessHeap () returned 0x350000 [0050.349] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0050.349] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0050.350] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0050.350] GetProcessHeap () returned 0x350000 [0050.350] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0050.350] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0050.353] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0050.354] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0050.354] GetProcessHeap () returned 0x350000 [0050.354] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0050.354] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0050.354] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0050.354] GetProcessHeap () returned 0x350000 [0050.354] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0050.354] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0050.356] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0050.357] GetProcessHeap () returned 0x350000 [0050.357] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0050.357] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0050.358] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0050.358] GetProcessHeap () returned 0x350000 [0050.358] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0050.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0050.359] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0050.359] GetProcessHeap () returned 0x350000 [0050.359] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0050.359] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0050.359] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0050.360] GetProcessHeap () returned 0x350000 [0050.360] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0050.360] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0050.360] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0050.360] GetProcessHeap () returned 0x350000 [0050.360] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0050.360] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0050.361] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0050.361] GetProcessHeap () returned 0x350000 [0050.361] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0050.361] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0050.362] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0050.362] GetProcessHeap () returned 0x350000 [0050.362] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0050.362] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0050.362] GetProcessHeap () returned 0x350000 [0050.362] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0050.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0050.363] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0050.363] GetProcessHeap () returned 0x350000 [0050.363] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0050.363] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0050.364] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0050.364] GetProcessHeap () returned 0x350000 [0050.364] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0050.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0050.364] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0050.364] GetProcessHeap () returned 0x350000 [0050.365] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0050.365] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0050.366] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0050.366] GetProcessHeap () returned 0x350000 [0050.366] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0050.367] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0050.367] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0050.367] GetProcessHeap () returned 0x350000 [0050.367] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0050.367] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0050.368] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0050.368] GetProcessHeap () returned 0x350000 [0050.368] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0050.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0050.369] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0050.369] GetProcessHeap () returned 0x350000 [0050.369] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0050.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0052.471] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0052.472] GetProcessHeap () returned 0x350000 [0052.472] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0052.472] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0052.472] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0052.472] GetProcessHeap () returned 0x350000 [0052.473] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0052.473] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0052.473] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0052.473] GetProcessHeap () returned 0x350000 [0052.473] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0052.473] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0052.474] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0052.474] GetProcessHeap () returned 0x350000 [0052.474] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0052.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.791] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.791] GetProcessHeap () returned 0x350000 [0052.791] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0052.792] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.792] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.792] GetProcessHeap () returned 0x350000 [0052.792] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0052.792] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.792] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.792] GetProcessHeap () returned 0x350000 [0052.793] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0052.793] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.793] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.793] GetProcessHeap () returned 0x350000 [0052.793] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0052.793] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.794] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.794] GetProcessHeap () returned 0x350000 [0052.794] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0052.794] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.794] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.794] GetProcessHeap () returned 0x350000 [0052.794] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0052.794] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.794] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.795] GetProcessHeap () returned 0x350000 [0052.795] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0052.795] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.795] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.795] GetProcessHeap () returned 0x350000 [0052.795] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0052.795] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.795] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.796] GetProcessHeap () returned 0x350000 [0052.796] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0052.796] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.796] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.796] GetProcessHeap () returned 0x350000 [0052.796] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0052.796] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.796] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.796] GetProcessHeap () returned 0x350000 [0052.796] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0052.796] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.797] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.797] GetProcessHeap () returned 0x350000 [0052.797] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0052.797] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.797] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.797] GetProcessHeap () returned 0x350000 [0052.797] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0052.797] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.798] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.798] GetProcessHeap () returned 0x350000 [0052.798] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0052.798] FindClose (in: hFindFile=0x3422220 | out: hFindFile=0x3422220) returned 1 [0052.798] GetProcessHeap () returned 0x350000 [0052.798] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34760a8 | out: hHeap=0x350000) returned 1 [0052.798] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422220 [0052.799] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.799] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 1 [0052.799] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 0 [0052.799] FindClose (in: hFindFile=0x3422220 | out: hFindFile=0x3422220) returned 1 [0052.799] GetProcessHeap () returned 0x350000 [0052.799] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34760a8 | out: hHeap=0x350000) returned 1 [0052.799] FindNextFileW (in: hFindFile=0x34221e0, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0052.800] GetProcessHeap () returned 0x350000 [0052.800] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34760a8 [0052.800] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422220 [0052.800] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.800] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0052.800] GetProcessHeap () returned 0x350000 [0052.800] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b65d0 [0052.800] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.800] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.802] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0052.802] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 0 [0052.802] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.802] GetProcessHeap () returned 0x350000 [0052.802] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0052.802] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0052.803] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0 [0052.803] FindClose (in: hFindFile=0x3422220 | out: hFindFile=0x3422220) returned 1 [0052.803] GetProcessHeap () returned 0x350000 [0052.803] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34760a8 | out: hHeap=0x350000) returned 1 [0052.803] FindNextFileW (in: hFindFile=0x34221e0, lpFindFileData=0x29feec8 | out: lpFindFileData=0x29feec8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0052.803] GetProcessHeap () returned 0x350000 [0052.803] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34760a8 [0052.803] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422220 [0052.803] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.803] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0052.804] GetProcessHeap () returned 0x350000 [0052.804] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b65d0 [0052.804] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.805] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.805] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0x305a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1 [0052.805] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0xcdb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBCI.DLL", cAlternateFileName="")) returned 1 [0052.805] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x51d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERECR.DLL", cAlternateFileName="")) returned 1 [0052.806] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xd2990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSTR.DLL", cAlternateFileName="")) returned 1 [0052.806] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f139500, ftCreationTime.dwHighDateTime=0x1c69359, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7f139500, ftLastWriteTime.dwHighDateTime=0x1c69359, nFileSizeHigh=0x0, nFileSizeLow=0x19a3ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO210.CHM", cAlternateFileName="")) returned 1 [0052.806] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b06d00, ftCreationTime.dwHighDateTime=0x1ca9127, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe4b06d00, ftLastWriteTime.dwHighDateTime=0x1ca9127, nFileSizeHigh=0x0, nFileSizeLow=0x25b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALRTINTL.DLL", cAlternateFileName="")) returned 1 [0052.806] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xc24a9ec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x269380, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL", cAlternateFileName="")) returned 1 [0052.806] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b30dd00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5b30dd00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0xd980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.IDX_DLL", cAlternateFileName="MSOINT~1.IDX")) returned 1 [0052.807] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c620a00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee8f1b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c620a00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x152f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.IDX_DLL", cAlternateFileName="MSOINT~2.IDX")) returned 1 [0052.807] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAPR3.DLL", cAlternateFileName="")) returned 1 [0052.807] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x356f9800, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x356f9800, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OARPMANR.DLL", cAlternateFileName="")) returned 1 [0052.807] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d183e00, ftCreationTime.dwHighDateTime=0x1ca520c, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d183e00, ftLastWriteTime.dwHighDateTime=0x1ca520c, nFileSizeHigh=0x0, nFileSizeLow=0x795, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.HTM", cAlternateFileName="")) returned 1 [0052.808] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 1 [0052.808] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 0 [0052.808] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.809] GetProcessHeap () returned 0x350000 [0052.809] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0052.809] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703dbc00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xd80a4ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x703dbc00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x310788, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0052.809] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd80f11a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0052.810] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xa990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEERR.DLL", cAlternateFileName="")) returned 1 [0052.810] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xf73a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEES.DLL", cAlternateFileName="")) returned 1 [0052.810] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCH.DLL", cAlternateFileName="")) returned 1 [0052.810] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xdbb98, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCL.DLL", cAlternateFileName="")) returned 1 [0052.811] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x53bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBC.DLL", cAlternateFileName="")) returned 1 [0052.811] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODDBS.DLL", cAlternateFileName="")) returned 1 [0052.811] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODEXL.DLL", cAlternateFileName="")) returned 1 [0052.811] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODTXT.DLL", cAlternateFileName="")) returned 1 [0052.811] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8189720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x833a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEOLEDB.DLL", cAlternateFileName="")) returned 1 [0052.812] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96faef00, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd8247e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96faef00, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x6e398, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACER3X.DLL", cAlternateFileName="")) returned 1 [0052.812] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0xd9c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERCLR.DLL", cAlternateFileName="")) returned 1 [0052.812] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xa8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEREP.DLL", cAlternateFileName="")) returned 1 [0052.812] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82940c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x48990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACETXT.DLL", cAlternateFileName="")) returned 1 [0052.813] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1092c00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xd82ba220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1092c00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x2e8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWDAT.DLL", cAlternateFileName="")) returned 1 [0052.813] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0c9f00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xcf0c7d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8e0c9f00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x4dba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSS.DLL", cAlternateFileName="")) returned 1 [0052.813] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82e0380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x7a998, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEXBE.DLL", cAlternateFileName="")) returned 1 [0052.813] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c38700, ftCreationTime.dwHighDateTime=0x1cbc9fc, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x67c38700, ftLastWriteTime.dwHighDateTime=0x1cbc9fc, nFileSizeHigh=0x0, nFileSizeLow=0x5e158, dwReserved0=0x0, dwReserved1=0x0, cFileName="ATLCONV.DLL", cAlternateFileName="")) returned 1 [0052.813] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb10f7500, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0xda5b0540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb10f7500, ftLastWriteTime.dwHighDateTime=0x1cbe56c, nFileSizeHigh=0x0, nFileSizeLow=0x4d67b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Csi.dll", cAlternateFileName="")) returned 1 [0052.814] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef87d800, ftCreationTime.dwHighDateTime=0x1cb8cce, ftLastAccessTime.dwLowDateTime=0xda5d66a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xef87d800, ftLastWriteTime.dwHighDateTime=0x1cb8cce, nFileSizeHigh=0x0, nFileSizeLow=0x1b3980, dwReserved0=0x0, dwReserved1=0x0, cFileName="CsiSoap.dll", cAlternateFileName="")) returned 1 [0052.815] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cultures", cAlternateFileName="")) returned 1 [0052.815] GetProcessHeap () returned 0x350000 [0052.815] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b65d0 [0052.815] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.815] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.815] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0052.816] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 0 [0052.816] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.816] GetProcessHeap () returned 0x350000 [0052.816] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3b65d0 | out: hHeap=0x350000) returned 1 [0052.816] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x7eb48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0052.816] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebd7300, ftCreationTime.dwHighDateTime=0x1cba5c3, ftLastAccessTime.dwLowDateTime=0xcef710e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3ebd7300, ftLastWriteTime.dwHighDateTime=0x1cba5c3, nFileSizeHigh=0x0, nFileSizeLow=0x21d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_PDF.DLL", cAlternateFileName="")) returned 1 [0052.816] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5bf6900, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf5b0aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5bf6900, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x11578, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_XPS.DLL", cAlternateFileName="")) returned 1 [0052.817] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd66e7600, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xe572de20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd66e7600, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x26560, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLTLDR.EXE", cAlternateFileName="")) returned 1 [0052.817] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7bf3f00, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7bf3f00, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x417360, dwReserved0=0x0, dwReserved1=0x0, cFileName="IACOM2.DLL", cAlternateFileName="")) returned 1 [0052.817] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x31d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1 [0052.817] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc821f600, ftCreationTime.dwHighDateTime=0x1cbdfb3, ftLastAccessTime.dwLowDateTime=0xd776b9a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc821f600, ftLastWriteTime.dwHighDateTime=0x1cbdfb3, nFileSizeHigh=0x0, nFileSizeLow=0x183d780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.DLL", cAlternateFileName="")) returned 1 [0052.817] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee94c400, ftCreationTime.dwHighDateTime=0x1cb7007, ftLastAccessTime.dwLowDateTime=0xd6225500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xee94c400, ftLastWriteTime.dwHighDateTime=0x1cb7007, nFileSizeHigh=0x0, nFileSizeLow=0x73b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOICONS.EXE", cAlternateFileName="")) returned 1 [0052.817] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xec32f3e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x4529780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSORES.DLL", cAlternateFileName="")) returned 1 [0052.818] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4293d00, ftCreationTime.dwHighDateTime=0x1cbc468, ftLastAccessTime.dwLowDateTime=0xd77dddc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa4293d00, ftLastWriteTime.dwHighDateTime=0x1cbc468, nFileSizeHigh=0x0, nFileSizeLow=0x135f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoshext.dll", cAlternateFileName="")) returned 1 [0052.818] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc276d800, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6a050eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc276d800, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdb50, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXEV.DLL", cAlternateFileName="")) returned 1 [0052.818] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d950, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLED.EXE", cAlternateFileName="")) returned 1 [0052.818] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xdb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLMF.DLL", cAlternateFileName="")) returned 1 [0052.818] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3922200, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3922200, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x124980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPTLS.DLL", cAlternateFileName="")) returned 1 [0052.819] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xac370, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAP30.DLL", cAlternateFileName="")) returned 1 [0052.819] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x1a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUAUTH.CAB", cAlternateFileName="")) returned 1 [0052.819] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x6190, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUOPTIN.DLL", cAlternateFileName="")) returned 1 [0052.819] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x161d5800, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xd63a22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x161d5800, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x38d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oarpmany.exe", cAlternateFileName="")) returned 1 [0052.819] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d2900, ftCreationTime.dwHighDateTime=0x1cab9ac, ftLastAccessTime.dwLowDateTime=0xbe0f9da0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7f9d2900, ftLastWriteTime.dwHighDateTime=0x1cab9ac, nFileSizeHigh=0x0, nFileSizeLow=0x7568, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBCMON.DLL", cAlternateFileName="")) returned 1 [0052.819] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x29fec40 | out: lpFindFileData=0x29fec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0052.820] GetProcessHeap () returned 0x350000 [0052.820] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3b65d0 [0052.820] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*", lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0053.057] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.058] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0053.058] GetProcessHeap () returned 0x350000 [0053.058] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34980b8 [0053.058] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.061] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.061] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 1 [0053.061] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.XML", cAlternateFileName="ACCESS~2.XML")) returned 1 [0053.061] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0053.062] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0053.062] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.063] GetProcessHeap () returned 0x350000 [0053.063] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34980b8 | out: hHeap=0x350000) returned 1 [0053.063] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1 [0053.063] GetProcessHeap () returned 0x350000 [0053.063] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34980b8 [0053.063] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.064] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.064] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1 [0053.065] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0053.065] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0053.065] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.065] GetProcessHeap () returned 0x350000 [0053.065] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34980b8 | out: hHeap=0x350000) returned 1 [0053.065] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1 [0053.065] GetProcessHeap () returned 0x350000 [0053.065] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34980b8 [0053.065] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.066] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.066] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1 [0053.067] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0053.067] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0053.067] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.067] GetProcessHeap () returned 0x350000 [0053.067] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34980b8 | out: hHeap=0x350000) returned 1 [0053.067] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 [0053.067] GetProcessHeap () returned 0x350000 [0053.067] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34980b8 [0053.067] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.068] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.068] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 1 [0053.069] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0053.069] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0053.069] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.069] GetProcessHeap () returned 0x350000 [0053.069] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34980b8 | out: hHeap=0x350000) returned 1 [0053.069] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0053.069] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 1 [0053.070] GetProcessHeap () returned 0x350000 [0053.070] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34980b8 [0053.070] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.072] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.072] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1 [0053.072] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470e1800, ftCreationTime.dwHighDateTime=0x1caccea, ftLastAccessTime.dwLowDateTime=0x15334ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x470e1800, ftLastWriteTime.dwHighDateTime=0x1caccea, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.XML", cAlternateFileName="")) returned 1 [0053.072] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4114ea00, ftCreationTime.dwHighDateTime=0x1ca6af2, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4114ea00, ftLastWriteTime.dwHighDateTime=0x1ca6af2, nFileSizeHigh=0x0, nFileSizeLow=0x11644, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCT.CHM", cAlternateFileName="")) returned 1 [0053.072] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c27050, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0053.073] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.XML", cAlternateFileName="OFFICE~2.XML")) returned 1 [0053.073] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUPUI.DLL", cAlternateFileName="")) returned 1 [0053.073] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4804a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd4804a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="promointl.dll", cAlternateFileName="PROMOI~1.DLL")) returned 1 [0053.074] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0b6300, ftCreationTime.dwHighDateTime=0x1ca9107, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2d0b6300, ftLastWriteTime.dwHighDateTime=0x1ca9107, nFileSizeHigh=0x0, nFileSizeLow=0x9339, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSCONFIG.CHM", cAlternateFileName="")) returned 1 [0053.074] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a8bce00, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7a8bce00, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6931, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSS10O.CHM", cAlternateFileName="")) returned 1 [0053.074] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d4800, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa7d4800, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSS10R.CHM", cAlternateFileName="")) returned 1 [0053.074] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49087c00, ftCreationTime.dwHighDateTime=0x1ca95c1, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49087c00, ftLastWriteTime.dwHighDateTime=0x1ca95c1, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.CHM", cAlternateFileName="")) returned 1 [0053.074] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0053.075] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0053.075] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.076] GetProcessHeap () returned 0x350000 [0053.076] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34980b8 | out: hHeap=0x350000) returned 1 [0053.076] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1 [0053.076] GetProcessHeap () returned 0x350000 [0053.076] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34980b8 [0053.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.077] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.077] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0053.078] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0053.078] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0053.078] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.078] GetProcessHeap () returned 0x350000 [0053.078] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34980b8 | out: hHeap=0x350000) returned 1 [0053.078] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0053.078] GetProcessHeap () returned 0x350000 [0053.078] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34980b8 [0053.078] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.085] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.085] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0053.085] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 0 [0053.085] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.085] GetProcessHeap () returned 0x350000 [0053.085] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34980b8 | out: hHeap=0x350000) returned 1 [0053.085] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1 [0053.086] GetProcessHeap () returned 0x350000 [0053.086] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34980b8 [0053.086] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.088] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.088] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0053.088] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0053.088] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0053.088] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.088] GetProcessHeap () returned 0x350000 [0053.089] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34980b8 | out: hHeap=0x350000) returned 1 [0053.089] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0053.089] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0xb9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSetupPS.dll", cAlternateFileName="")) returned 1 [0053.089] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.en-us", cAlternateFileName="OUTLOO~1.EN-")) returned 1 [0053.089] GetProcessHeap () returned 0x350000 [0053.089] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34980b8 [0053.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.300] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.300] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0053.300] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0053.300] FindNextFileW (in: hFindFile=0x3422320, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0053.301] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.301] GetProcessHeap () returned 0x350000 [0053.301] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34980b8 | out: hHeap=0x350000) returned 1 [0053.301] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0053.301] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17eefe00, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17eefe00, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0053.301] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6904ef00, ftCreationTime.dwHighDateTime=0x1ca912c, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6904ef00, ftLastWriteTime.dwHighDateTime=0x1ca912c, nFileSizeHigh=0x0, nFileSizeLow=0x3d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0053.301] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPoint.en-us", cAlternateFileName="POWERP~1.EN-")) returned 1 [0053.301] GetProcessHeap () returned 0x350000 [0053.301] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34980b8 [0053.302] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0053.329] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.347] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.XML", cAlternateFileName="POWERP~1.XML")) returned 1 [0053.347] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0053.347] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0053.347] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0053.348] GetProcessHeap () returned 0x350000 [0053.348] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34980b8 | out: hHeap=0x350000) returned 1 [0053.348] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJPROR", cAlternateFileName="")) returned 1 [0053.348] GetProcessHeap () returned 0x350000 [0053.348] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34980b8 [0053.348] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0053.348] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.348] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.XML", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0053.348] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0053.348] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0053.348] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0053.349] GetProcessHeap () returned 0x350000 [0053.349] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34980b8 | out: hHeap=0x350000) returned 1 [0053.349] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project.en-us", cAlternateFileName="PROJEC~1.EN-")) returned 1 [0053.349] GetProcessHeap () returned 0x350000 [0053.349] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34980b8 [0053.349] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0053.349] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.349] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.XML", cAlternateFileName="PROJEC~1.XML")) returned 1 [0053.349] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0053.349] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0053.349] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0053.350] GetProcessHeap () returned 0x350000 [0053.350] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34980b8 | out: hHeap=0x350000) returned 1 [0053.350] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0053.350] GetProcessHeap () returned 0x350000 [0053.350] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34980b8 [0053.350] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0053.350] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.350] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0053.350] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0053.350] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0053.350] GetProcessHeap () returned 0x350000 [0053.351] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34980b8 | out: hHeap=0x350000) returned 1 [0053.351] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0053.351] GetProcessHeap () returned 0x350000 [0053.351] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34980b8 [0053.351] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0053.351] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.351] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0053.351] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0053.351] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0053.351] GetProcessHeap () returned 0x350000 [0053.351] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34980b8 | out: hHeap=0x350000) returned 1 [0053.351] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0053.352] GetProcessHeap () returned 0x350000 [0053.352] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34980b8 [0053.352] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0053.352] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.352] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0053.352] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0053.352] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0053.352] GetProcessHeap () returned 0x350000 [0053.352] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34980b8 | out: hHeap=0x350000) returned 1 [0053.352] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1 [0053.353] GetProcessHeap () returned 0x350000 [0053.353] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34980b8 [0053.353] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0053.353] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.353] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.XML", cAlternateFileName="")) returned 1 [0053.353] ResetEvent (hEvent=0x168) returned 1 [0053.353] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xffffffff) returned 0x0 [0055.213] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0055.213] ResetEvent (hEvent=0x168) returned 1 [0055.213] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xffffffff) returned 0x0 [0055.256] ResetEvent (hEvent=0x168) returned 1 [0055.256] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xffffffff) returned 0x0 [0058.873] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0058.881] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0058.882] GetProcessHeap () returned 0x350000 [0058.882] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34980b8 | out: hHeap=0x350000) returned 1 [0058.882] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPLUSR", cAlternateFileName="")) returned 1 [0058.884] GetProcessHeap () returned 0x350000 [0058.884] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34980b8 [0058.884] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0058.884] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.884] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.XML", cAlternateFileName="PROPLU~1.XML")) returned 1 [0058.885] ResetEvent (hEvent=0x168) returned 1 [0058.885] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xffffffff) returned 0x0 [0059.615] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0059.615] ResetEvent (hEvent=0x168) returned 1 [0059.616] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xffffffff) returned 0x0 [0061.165] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0061.165] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0061.165] GetProcessHeap () returned 0x350000 [0061.165] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34980b8 | out: hHeap=0x350000) returned 1 [0061.249] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher.en-us", cAlternateFileName="PUBLIS~1.EN-")) returned 1 [0061.249] GetProcessHeap () returned 0x350000 [0061.249] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3400068 [0061.249] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0061.249] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.249] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.XML", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0061.250] ResetEvent (hEvent=0x168) returned 1 [0061.250] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xffffffff) returned 0x0 [0061.726] ResetEvent (hEvent=0x168) returned 1 [0061.726] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xffffffff) returned 0x0 [0062.561] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0062.561] ResetEvent (hEvent=0x168) returned 1 [0062.561] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xffffffff) returned 0x0 [0063.505] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0063.505] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0063.505] GetProcessHeap () returned 0x350000 [0063.505] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3400068 | out: hHeap=0x350000) returned 1 [0063.505] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0063.505] ResetEvent (hEvent=0x168) returned 1 [0063.505] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xffffffff) returned 0x0 [0069.897] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio.en-us", cAlternateFileName="VISIO~1.EN-")) returned 1 [0069.897] GetProcessHeap () returned 0x350000 [0069.897] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3700048 [0069.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0069.898] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.899] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0069.899] ResetEvent (hEvent=0x168) returned 1 [0069.899] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xffffffff) returned 0x0 [0070.617] ResetEvent (hEvent=0x168) returned 1 [0070.617] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xffffffff) returned 0x0 [0070.657] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 1 [0070.657] ResetEvent (hEvent=0x168) returned 1 [0070.657] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xffffffff) returned 0x0 [0070.673] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 0 [0070.673] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0070.673] GetProcessHeap () returned 0x350000 [0070.673] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3700048 | out: hHeap=0x350000) returned 1 [0070.673] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x29fe9b8 | out: lpFindFileData=0x29fe9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIOR", cAlternateFileName="")) returned 1 [0070.673] GetProcessHeap () returned 0x350000 [0070.673] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3700048 [0070.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*", lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0070.674] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.674] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0070.674] ResetEvent (hEvent=0x168) returned 1 [0070.674] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xffffffff) returned 0x0 [0070.728] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x29fe730 | out: lpFindFileData=0x29fe730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 1 [0070.729] ResetEvent (hEvent=0x168) returned 1 [0070.729] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xffffffff) Thread: id = 19 os_tid = 0x5bc [0045.426] GetProcessHeap () returned 0x350000 [0045.426] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x38) returned 0x375228 [0045.426] GetProcessHeap () returned 0x350000 [0045.426] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x18) returned 0x36e428 [0045.426] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x184 [0045.426] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x188 [0045.426] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x18c [0045.426] GetProcessHeap () returned 0x350000 [0045.426] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3c75e0 [0045.427] GetProcessHeap () returned 0x350000 [0045.427] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3d75e8 [0045.428] GetProcessHeap () returned 0x350000 [0045.428] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x50) returned 0x36f6d8 [0045.428] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0045.428] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0045.428] Wow64DisableWow64FsRedirection (in: OldValue=0x2dbfd74 | out: OldValue=0x2dbfd74*=0x0) returned 1 [0045.428] GetProcessHeap () returned 0x350000 [0045.428] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36f6d8 | out: hHeap=0x350000) returned 1 [0045.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x12653ac, lpParameter=0x2dbfd7c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x190 [0045.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x12653ac, lpParameter=0x2dbfd7c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x194 [0045.431] GetProcessHeap () returned 0x350000 [0045.431] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3e75f0 [0045.431] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x2dbfaf0 | out: lpFindFileData=0x2dbfaf0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x375268 [0045.431] GetProcessHeap () returned 0x350000 [0045.432] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3f75f8 [0045.433] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3752a8 [0045.433] FindNextFileW (in: hFindFile=0x3752a8, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.433] FindNextFileW (in: hFindFile=0x3752a8, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0045.434] GetProcessHeap () returned 0x350000 [0045.434] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x408608 [0045.434] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3752e8 [0045.434] FindNextFileW (in: hFindFile=0x3752e8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.434] FindNextFileW (in: hFindFile=0x3752e8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0045.434] FindNextFileW (in: hFindFile=0x3752e8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0045.435] FindClose (in: hFindFile=0x3752e8 | out: hFindFile=0x3752e8) returned 1 [0045.435] GetProcessHeap () returned 0x350000 [0045.435] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x408608 | out: hHeap=0x350000) returned 1 [0045.435] FindNextFileW (in: hFindFile=0x3752a8, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0045.435] FindClose (in: hFindFile=0x3752a8 | out: hFindFile=0x3752a8) returned 1 [0045.435] GetProcessHeap () returned 0x350000 [0045.435] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3f75f8 | out: hHeap=0x350000) returned 1 [0045.435] FindNextFileW (in: hFindFile=0x375268, lpFindFileData=0x2dbfaf0 | out: lpFindFileData=0x2dbfaf0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0045.435] GetProcessHeap () returned 0x350000 [0045.435] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3f8600 [0045.435] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xfb2cc20, ftLastAccessTime.dwHighDateTime=0x1d67630, ftLastWriteTime.dwLowDateTime=0xfb2cc20, ftLastWriteTime.dwHighDateTime=0x1d67630, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x375368 [0049.037] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xfb2cc20, ftLastAccessTime.dwHighDateTime=0x1d67630, ftLastWriteTime.dwLowDateTime=0xfb2cc20, ftLastWriteTime.dwHighDateTime=0x1d67630, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.135] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0049.136] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x9098e7a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0049.136] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0049.136] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0049.136] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0049.136] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xfb2cc20, ftCreationTime.dwHighDateTime=0x1d67630, ftLastAccessTime.dwLowDateTime=0xfb2cc20, ftLastAccessTime.dwHighDateTime=0x1d67630, ftLastWriteTime.dwLowDateTime=0xfb2cc20, ftLastWriteTime.dwHighDateTime=0x1d67630, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight", cAlternateFileName="BOOTST~1.EIG")) returned 1 [0049.136] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0049.136] GetProcessHeap () returned 0x350000 [0049.136] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3401070 [0049.137] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x371fc8 [0049.137] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.137] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.138] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.138] FindClose (in: hFindFile=0x371fc8 | out: hFindFile=0x371fc8) returned 1 [0049.138] GetProcessHeap () returned 0x350000 [0049.138] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3401070 | out: hHeap=0x350000) returned 1 [0049.138] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0049.138] GetProcessHeap () returned 0x350000 [0049.138] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3401070 [0049.138] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x371fc8 [0049.138] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.138] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.139] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.139] FindClose (in: hFindFile=0x371fc8 | out: hFindFile=0x371fc8) returned 1 [0049.139] GetProcessHeap () returned 0x350000 [0049.139] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3401070 | out: hHeap=0x350000) returned 1 [0049.139] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0049.139] GetProcessHeap () returned 0x350000 [0049.139] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3401070 [0049.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x371fc8 [0049.139] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.139] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.140] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.140] FindClose (in: hFindFile=0x371fc8 | out: hFindFile=0x371fc8) returned 1 [0049.140] GetProcessHeap () returned 0x350000 [0049.140] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3401070 | out: hHeap=0x350000) returned 1 [0049.140] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0049.140] GetProcessHeap () returned 0x350000 [0049.140] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3401070 [0049.140] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x371fc8 [0049.140] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.141] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.141] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.141] FindClose (in: hFindFile=0x371fc8 | out: hFindFile=0x371fc8) returned 1 [0049.141] GetProcessHeap () returned 0x350000 [0049.141] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3401070 | out: hHeap=0x350000) returned 1 [0049.141] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0049.141] GetProcessHeap () returned 0x350000 [0049.141] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3401070 [0049.141] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x371fc8 [0049.142] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.142] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.142] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0049.142] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0049.142] FindClose (in: hFindFile=0x371fc8 | out: hFindFile=0x371fc8) returned 1 [0049.142] GetProcessHeap () returned 0x350000 [0049.142] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3401070 | out: hHeap=0x350000) returned 1 [0049.142] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0049.142] GetProcessHeap () returned 0x350000 [0049.142] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3401070 [0049.142] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x371fc8 [0049.142] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.143] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.143] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.143] FindClose (in: hFindFile=0x371fc8 | out: hFindFile=0x371fc8) returned 1 [0049.143] GetProcessHeap () returned 0x350000 [0049.143] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3401070 | out: hHeap=0x350000) returned 1 [0049.143] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0049.143] GetProcessHeap () returned 0x350000 [0049.143] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3401070 [0049.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x371fc8 [0049.143] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.143] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.144] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.144] FindClose (in: hFindFile=0x371fc8 | out: hFindFile=0x371fc8) returned 1 [0049.144] GetProcessHeap () returned 0x350000 [0049.144] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3401070 | out: hHeap=0x350000) returned 1 [0049.144] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0049.144] GetProcessHeap () returned 0x350000 [0049.144] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3401070 [0049.144] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x371fc8 [0049.144] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.144] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0049.144] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0049.144] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0049.145] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0049.145] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0049.145] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0049.145] FindClose (in: hFindFile=0x371fc8 | out: hFindFile=0x371fc8) returned 1 [0049.145] GetProcessHeap () returned 0x350000 [0049.145] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3401070 | out: hHeap=0x350000) returned 1 [0049.145] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0049.145] GetProcessHeap () returned 0x350000 [0049.145] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3401070 [0049.145] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x371fc8 [0049.145] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.145] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.145] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.145] FindClose (in: hFindFile=0x371fc8 | out: hFindFile=0x371fc8) returned 1 [0049.146] GetProcessHeap () returned 0x350000 [0049.146] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3401070 | out: hHeap=0x350000) returned 1 [0049.146] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0049.146] GetProcessHeap () returned 0x350000 [0049.146] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3401070 [0049.146] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x371fc8 [0049.146] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.146] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.146] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.146] FindClose (in: hFindFile=0x371fc8 | out: hFindFile=0x371fc8) returned 1 [0049.146] GetProcessHeap () returned 0x350000 [0049.146] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3401070 | out: hHeap=0x350000) returned 1 [0049.146] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0049.147] GetProcessHeap () returned 0x350000 [0049.147] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3401070 [0049.147] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x371fc8 [0049.147] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.147] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.147] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.147] FindClose (in: hFindFile=0x371fc8 | out: hFindFile=0x371fc8) returned 1 [0049.147] GetProcessHeap () returned 0x350000 [0049.147] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3401070 | out: hHeap=0x350000) returned 1 [0049.147] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0049.147] GetProcessHeap () returned 0x350000 [0049.147] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3401070 [0049.147] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x371fc8 [0049.148] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.148] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.148] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.148] FindClose (in: hFindFile=0x371fc8 | out: hFindFile=0x371fc8) returned 1 [0049.148] GetProcessHeap () returned 0x350000 [0049.148] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3401070 | out: hHeap=0x350000) returned 1 [0049.148] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0049.148] GetProcessHeap () returned 0x350000 [0049.149] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3401070 [0049.149] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x371fc8 [0049.185] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.186] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.186] FindNextFileW (in: hFindFile=0x371fc8, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.186] FindClose (in: hFindFile=0x371fc8 | out: hFindFile=0x371fc8) returned 1 [0049.186] GetProcessHeap () returned 0x350000 [0049.186] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3401070 | out: hHeap=0x350000) returned 1 [0049.186] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0049.186] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0049.186] GetProcessHeap () returned 0x350000 [0049.186] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3401070 [0049.186] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34220a0 [0049.187] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.187] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.187] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.187] FindClose (in: hFindFile=0x34220a0 | out: hFindFile=0x34220a0) returned 1 [0049.187] GetProcessHeap () returned 0x350000 [0049.187] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3401070 | out: hHeap=0x350000) returned 1 [0049.187] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0049.187] GetProcessHeap () returned 0x350000 [0049.187] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3401070 [0049.187] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34220a0 [0049.187] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.187] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.188] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.188] FindClose (in: hFindFile=0x34220a0 | out: hFindFile=0x34220a0) returned 1 [0049.188] GetProcessHeap () returned 0x350000 [0049.188] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3401070 | out: hHeap=0x350000) returned 1 [0049.188] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0049.188] GetProcessHeap () returned 0x350000 [0049.188] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3401070 [0049.188] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34220a0 [0049.188] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.188] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.188] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.188] FindClose (in: hFindFile=0x34220a0 | out: hFindFile=0x34220a0) returned 1 [0049.188] GetProcessHeap () returned 0x350000 [0049.188] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3401070 | out: hHeap=0x350000) returned 1 [0049.189] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0049.189] GetProcessHeap () returned 0x350000 [0049.189] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3401070 [0049.189] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34220a0 [0049.189] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.189] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.189] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.189] FindClose (in: hFindFile=0x34220a0 | out: hFindFile=0x34220a0) returned 1 [0049.189] GetProcessHeap () returned 0x350000 [0049.189] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3401070 | out: hHeap=0x350000) returned 1 [0049.189] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0049.189] GetProcessHeap () returned 0x350000 [0049.189] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3401070 [0049.189] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34220a0 [0049.190] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.190] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.190] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.190] FindClose (in: hFindFile=0x34220a0 | out: hFindFile=0x34220a0) returned 1 [0049.190] GetProcessHeap () returned 0x350000 [0049.190] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3401070 | out: hHeap=0x350000) returned 1 [0049.190] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0049.190] GetProcessHeap () returned 0x350000 [0049.190] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3401070 [0049.190] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34220a0 [0049.190] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.190] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.190] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.191] FindClose (in: hFindFile=0x34220a0 | out: hFindFile=0x34220a0) returned 1 [0049.191] GetProcessHeap () returned 0x350000 [0049.191] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3401070 | out: hHeap=0x350000) returned 1 [0049.191] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0049.191] GetProcessHeap () returned 0x350000 [0049.191] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3401070 [0049.191] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34220a0 [0049.191] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.191] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.191] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.191] FindClose (in: hFindFile=0x34220a0 | out: hFindFile=0x34220a0) returned 1 [0049.191] GetProcessHeap () returned 0x350000 [0049.191] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3401070 | out: hHeap=0x350000) returned 1 [0049.191] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0049.192] GetProcessHeap () returned 0x350000 [0049.192] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3401070 [0049.192] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34220a0 [0049.192] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.192] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.192] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.192] FindClose (in: hFindFile=0x34220a0 | out: hFindFile=0x34220a0) returned 1 [0049.192] GetProcessHeap () returned 0x350000 [0049.192] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3401070 | out: hHeap=0x350000) returned 1 [0049.192] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0049.192] GetProcessHeap () returned 0x350000 [0049.192] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3401070 [0049.192] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34220a0 [0049.193] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.193] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.193] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.193] FindClose (in: hFindFile=0x34220a0 | out: hFindFile=0x34220a0) returned 1 [0049.193] GetProcessHeap () returned 0x350000 [0049.193] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3401070 | out: hHeap=0x350000) returned 1 [0049.193] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0049.193] GetProcessHeap () returned 0x350000 [0049.193] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3401070 [0049.193] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34220a0 [0049.193] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.193] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.194] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.194] FindClose (in: hFindFile=0x34220a0 | out: hFindFile=0x34220a0) returned 1 [0049.194] GetProcessHeap () returned 0x350000 [0049.194] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3401070 | out: hHeap=0x350000) returned 1 [0049.194] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0049.194] GetProcessHeap () returned 0x350000 [0049.194] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3401070 [0049.194] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34220a0 [0049.194] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.194] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0049.194] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0049.194] FindClose (in: hFindFile=0x34220a0 | out: hFindFile=0x34220a0) returned 1 [0049.194] GetProcessHeap () returned 0x350000 [0049.195] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3401070 | out: hHeap=0x350000) returned 1 [0049.195] FindNextFileW (in: hFindFile=0x375368, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0049.195] FindClose (in: hFindFile=0x375368 | out: hFindFile=0x375368) returned 1 [0049.195] GetProcessHeap () returned 0x350000 [0049.195] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3f8600 | out: hHeap=0x350000) returned 1 [0049.195] FindNextFileW (in: hFindFile=0x375268, lpFindFileData=0x2dbfaf0 | out: lpFindFileData=0x2dbfaf0*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0049.195] FindNextFileW (in: hFindFile=0x375268, lpFindFileData=0x2dbfaf0 | out: lpFindFileData=0x2dbfaf0*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0049.195] FindNextFileW (in: hFindFile=0x375268, lpFindFileData=0x2dbfaf0 | out: lpFindFileData=0x2dbfaf0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0049.195] GetProcessHeap () returned 0x350000 [0049.195] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3f8600 [0049.195] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Config.Msi\\*", lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34220a0 [0049.196] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.196] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0049.196] FindClose (in: hFindFile=0x34220a0 | out: hFindFile=0x34220a0) returned 1 [0049.196] GetProcessHeap () returned 0x350000 [0049.196] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3f8600 | out: hHeap=0x350000) returned 1 [0049.196] FindNextFileW (in: hFindFile=0x375268, lpFindFileData=0x2dbfaf0 | out: lpFindFileData=0x2dbfaf0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0049.196] FindNextFileW (in: hFindFile=0x375268, lpFindFileData=0x2dbfaf0 | out: lpFindFileData=0x2dbfaf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0049.196] FindNextFileW (in: hFindFile=0x375268, lpFindFileData=0x2dbfaf0 | out: lpFindFileData=0x2dbfaf0*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0049.196] GetProcessHeap () returned 0x350000 [0049.196] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3f8600 [0049.196] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\*", lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34220a0 [0049.197] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.197] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0049.197] GetProcessHeap () returned 0x350000 [0049.197] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3400068 [0049.197] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34220e0 [0049.197] FindNextFileW (in: hFindFile=0x34220e0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.197] FindNextFileW (in: hFindFile=0x34220e0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0049.197] GetProcessHeap () returned 0x350000 [0049.197] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3424090 [0049.198] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422120 [0049.198] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.198] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0049.199] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0049.199] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0049.199] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.199] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0049.199] FindClose (in: hFindFile=0x3422120 | out: hFindFile=0x3422120) returned 1 [0049.199] GetProcessHeap () returned 0x350000 [0049.199] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3424090 | out: hHeap=0x350000) returned 1 [0049.199] FindNextFileW (in: hFindFile=0x34220e0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0049.199] GetProcessHeap () returned 0x350000 [0049.199] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3424090 [0049.199] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422120 [0049.200] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.201] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0049.201] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0049.201] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0049.201] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.201] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0049.201] FindClose (in: hFindFile=0x3422120 | out: hFindFile=0x3422120) returned 1 [0049.202] GetProcessHeap () returned 0x350000 [0049.202] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3424090 | out: hHeap=0x350000) returned 1 [0049.202] FindNextFileW (in: hFindFile=0x34220e0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0049.202] GetProcessHeap () returned 0x350000 [0049.202] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3424090 [0049.202] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422120 [0049.430] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.430] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0049.430] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0049.430] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0049.430] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.430] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0049.430] FindClose (in: hFindFile=0x3422120 | out: hFindFile=0x3422120) returned 1 [0049.431] GetProcessHeap () returned 0x350000 [0049.431] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3424090 | out: hHeap=0x350000) returned 1 [0049.431] FindNextFileW (in: hFindFile=0x34220e0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0049.431] GetProcessHeap () returned 0x350000 [0049.431] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3424090 [0049.431] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422120 [0049.435] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.435] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0049.435] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0049.435] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0049.435] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.435] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0049.435] FindClose (in: hFindFile=0x3422120 | out: hFindFile=0x3422120) returned 1 [0049.436] GetProcessHeap () returned 0x350000 [0049.436] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3424090 | out: hHeap=0x350000) returned 1 [0049.436] FindNextFileW (in: hFindFile=0x34220e0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0049.437] GetProcessHeap () returned 0x350000 [0049.437] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3424090 [0049.437] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422120 [0049.438] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.438] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.438] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0049.438] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0049.438] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0049.438] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0049.438] FindClose (in: hFindFile=0x3422120 | out: hFindFile=0x3422120) returned 1 [0049.438] GetProcessHeap () returned 0x350000 [0049.438] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3424090 | out: hHeap=0x350000) returned 1 [0049.438] FindNextFileW (in: hFindFile=0x34220e0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0049.438] GetProcessHeap () returned 0x350000 [0049.438] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3424090 [0049.438] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422160 [0049.441] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.441] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0049.441] GetProcessHeap () returned 0x350000 [0049.441] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34370a0 [0049.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34221a0 [0049.599] FindNextFileW (in: hFindFile=0x34221a0, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.599] FindNextFileW (in: hFindFile=0x34221a0, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0049.599] FindNextFileW (in: hFindFile=0x34221a0, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0049.599] FindNextFileW (in: hFindFile=0x34221a0, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0049.600] FindNextFileW (in: hFindFile=0x34221a0, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0049.600] FindClose (in: hFindFile=0x34221a0 | out: hFindFile=0x34221a0) returned 1 [0049.600] GetProcessHeap () returned 0x350000 [0049.600] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34370a0 | out: hHeap=0x350000) returned 1 [0049.600] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0049.600] GetProcessHeap () returned 0x350000 [0049.600] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34370a0 [0049.600] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34221a0 [0049.601] FindNextFileW (in: hFindFile=0x34221a0, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.601] FindNextFileW (in: hFindFile=0x34221a0, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0049.601] FindNextFileW (in: hFindFile=0x34221a0, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0049.602] FindNextFileW (in: hFindFile=0x34221a0, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0049.602] FindNextFileW (in: hFindFile=0x34221a0, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0049.602] FindClose (in: hFindFile=0x34221a0 | out: hFindFile=0x34221a0) returned 1 [0049.602] GetProcessHeap () returned 0x350000 [0049.602] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34370a0 | out: hHeap=0x350000) returned 1 [0049.602] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0049.602] GetProcessHeap () returned 0x350000 [0049.602] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34370a0 [0049.602] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34221a0 [0049.602] FindNextFileW (in: hFindFile=0x34221a0, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.603] FindNextFileW (in: hFindFile=0x34221a0, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0049.603] FindNextFileW (in: hFindFile=0x34221a0, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0049.603] FindNextFileW (in: hFindFile=0x34221a0, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0049.603] FindNextFileW (in: hFindFile=0x34221a0, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0049.603] FindClose (in: hFindFile=0x34221a0 | out: hFindFile=0x34221a0) returned 1 [0049.603] GetProcessHeap () returned 0x350000 [0049.603] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34370a0 | out: hHeap=0x350000) returned 1 [0049.603] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0049.603] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0049.604] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.604] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0049.604] FindClose (in: hFindFile=0x3422160 | out: hFindFile=0x3422160) returned 1 [0049.604] GetProcessHeap () returned 0x350000 [0049.604] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3424090 | out: hHeap=0x350000) returned 1 [0049.604] FindNextFileW (in: hFindFile=0x34220e0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0049.604] GetProcessHeap () returned 0x350000 [0049.604] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3424090 [0049.604] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422160 [0049.801] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.801] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0049.801] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0049.801] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0049.802] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.802] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0049.802] FindClose (in: hFindFile=0x3422160 | out: hFindFile=0x3422160) returned 1 [0049.828] GetProcessHeap () returned 0x350000 [0049.828] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3424090 | out: hHeap=0x350000) returned 1 [0049.828] FindNextFileW (in: hFindFile=0x34220e0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0049.828] GetProcessHeap () returned 0x350000 [0049.829] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3424090 [0049.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422160 [0049.830] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.830] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0049.830] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0049.830] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0049.830] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.830] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0049.830] FindClose (in: hFindFile=0x3422160 | out: hFindFile=0x3422160) returned 1 [0049.832] GetProcessHeap () returned 0x350000 [0049.832] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3424090 | out: hHeap=0x350000) returned 1 [0049.832] FindNextFileW (in: hFindFile=0x34220e0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0049.832] GetProcessHeap () returned 0x350000 [0049.832] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3424090 [0049.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422160 [0049.832] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.832] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.832] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0049.832] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0049.833] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0049.833] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0049.833] FindClose (in: hFindFile=0x3422160 | out: hFindFile=0x3422160) returned 1 [0049.833] GetProcessHeap () returned 0x350000 [0049.833] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3424090 | out: hHeap=0x350000) returned 1 [0049.833] FindNextFileW (in: hFindFile=0x34220e0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0049.833] GetProcessHeap () returned 0x350000 [0049.833] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3424090 [0049.833] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422160 [0049.834] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.834] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0049.835] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0049.835] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0049.835] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.835] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0049.835] FindClose (in: hFindFile=0x3422160 | out: hFindFile=0x3422160) returned 1 [0049.836] GetProcessHeap () returned 0x350000 [0049.836] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3424090 | out: hHeap=0x350000) returned 1 [0049.836] FindNextFileW (in: hFindFile=0x34220e0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0049.836] GetProcessHeap () returned 0x350000 [0049.836] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3424090 [0049.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422160 [0049.838] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.838] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0049.838] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0049.838] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0049.838] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.838] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0049.838] FindClose (in: hFindFile=0x3422160 | out: hFindFile=0x3422160) returned 1 [0049.839] GetProcessHeap () returned 0x350000 [0049.840] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3424090 | out: hHeap=0x350000) returned 1 [0049.840] FindNextFileW (in: hFindFile=0x34220e0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0049.840] GetProcessHeap () returned 0x350000 [0049.840] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3424090 [0049.840] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422120 [0049.843] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.843] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0049.844] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0049.844] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0049.844] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.844] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0049.844] FindClose (in: hFindFile=0x3422120 | out: hFindFile=0x3422120) returned 1 [0049.845] GetProcessHeap () returned 0x350000 [0049.846] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3424090 | out: hHeap=0x350000) returned 1 [0049.846] FindNextFileW (in: hFindFile=0x34220e0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0049.846] GetProcessHeap () returned 0x350000 [0049.846] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3424090 [0049.846] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422120 [0049.848] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.848] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0049.848] GetProcessHeap () returned 0x350000 [0049.848] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3456098 [0049.848] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422160 [0049.849] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.850] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0049.850] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0049.850] FindClose (in: hFindFile=0x3422160 | out: hFindFile=0x3422160) returned 1 [0049.850] GetProcessHeap () returned 0x350000 [0049.850] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3456098 | out: hHeap=0x350000) returned 1 [0049.850] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0049.850] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0049.850] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0049.851] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0049.851] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0049.851] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0049.851] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0049.851] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0049.852] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0049.852] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0049.852] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0049.852] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0049.852] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0049.853] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0049.853] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0049.853] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0049.853] FindNextFileW (in: hFindFile=0x3422120, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0 [0049.853] FindClose (in: hFindFile=0x3422120 | out: hFindFile=0x3422120) returned 1 [0049.853] GetProcessHeap () returned 0x350000 [0049.854] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3424090 | out: hHeap=0x350000) returned 1 [0049.854] FindNextFileW (in: hFindFile=0x34220e0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0049.854] GetProcessHeap () returned 0x350000 [0049.854] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3424090 [0049.854] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422160 [0050.125] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.125] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0050.125] GetProcessHeap () returned 0x350000 [0050.125] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34660a0 [0050.125] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422220 [0050.126] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.126] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0050.126] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0050.126] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0050.126] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0050.126] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 0 [0050.126] FindClose (in: hFindFile=0x3422220 | out: hFindFile=0x3422220) returned 1 [0050.127] GetProcessHeap () returned 0x350000 [0050.127] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0050.127] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0050.128] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0050.128] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0050.128] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0050.128] FindClose (in: hFindFile=0x3422160 | out: hFindFile=0x3422160) returned 1 [0050.128] GetProcessHeap () returned 0x350000 [0050.128] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3424090 | out: hHeap=0x350000) returned 1 [0050.128] FindNextFileW (in: hFindFile=0x34220e0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~1")) returned 1 [0050.128] GetProcessHeap () returned 0x350000 [0050.128] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3424090 [0050.128] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422160 [0050.129] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.129] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0050.129] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0050.129] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0050.130] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0050.130] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0050.130] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0050.130] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0050.130] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.msi", cAlternateFileName="PROPLU~1.MSI")) returned 1 [0050.130] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 1 [0050.130] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW.cab", cAlternateFileName="")) returned 1 [0050.131] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW2.cab", cAlternateFileName="")) returned 1 [0050.131] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0050.131] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0050.131] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0050.131] FindClose (in: hFindFile=0x3422160 | out: hFindFile=0x3422160) returned 1 [0050.132] GetProcessHeap () returned 0x350000 [0050.132] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3424090 | out: hHeap=0x350000) returned 1 [0050.132] FindNextFileW (in: hFindFile=0x34220e0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0050.132] GetProcessHeap () returned 0x350000 [0050.132] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3424090 [0050.132] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422160 [0050.133] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.133] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0050.133] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0050.133] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0050.134] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0050.134] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0050.134] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0050.134] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0050.134] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.msi", cAlternateFileName="PRJPRO~1.MSI")) returned 1 [0050.134] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.xml", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0050.134] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjPrrWW.cab", cAlternateFileName="")) returned 1 [0050.134] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0050.134] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0050.134] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0050.134] FindClose (in: hFindFile=0x3422160 | out: hFindFile=0x3422160) returned 1 [0050.135] GetProcessHeap () returned 0x350000 [0050.135] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3424090 | out: hHeap=0x350000) returned 1 [0050.135] FindNextFileW (in: hFindFile=0x34220e0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0050.135] GetProcessHeap () returned 0x350000 [0050.136] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3424090 [0050.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422160 [0050.137] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.137] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0050.137] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0050.137] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0050.137] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0050.137] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0050.137] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0050.137] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0050.137] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0050.137] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0050.137] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.cab", cAlternateFileName="")) returned 1 [0050.138] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.msi", cAlternateFileName="")) returned 1 [0050.138] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 1 [0050.138] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 0 [0050.138] FindClose (in: hFindFile=0x3422160 | out: hFindFile=0x3422160) returned 1 [0050.139] GetProcessHeap () returned 0x350000 [0050.139] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3424090 | out: hHeap=0x350000) returned 1 [0050.139] FindNextFileW (in: hFindFile=0x34220e0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 0 [0050.139] FindClose (in: hFindFile=0x34220e0 | out: hFindFile=0x34220e0) returned 1 [0050.139] GetProcessHeap () returned 0x350000 [0050.139] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3400068 | out: hHeap=0x350000) returned 1 [0050.139] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 0 [0050.139] FindClose (in: hFindFile=0x34220a0 | out: hFindFile=0x34220a0) returned 1 [0050.139] GetProcessHeap () returned 0x350000 [0050.139] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3f8600 | out: hHeap=0x350000) returned 1 [0050.141] FindNextFileW (in: hFindFile=0x375268, lpFindFileData=0x2dbfaf0 | out: lpFindFileData=0x2dbfaf0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xaece4da0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0050.141] FindNextFileW (in: hFindFile=0x375268, lpFindFileData=0x2dbfaf0 | out: lpFindFileData=0x2dbfaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0050.141] GetProcessHeap () returned 0x350000 [0050.141] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3f8600 [0050.142] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34220a0 [0050.142] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.142] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0050.142] GetProcessHeap () returned 0x350000 [0050.142] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3423088 [0050.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\Admin\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34220e0 [0050.143] FindNextFileW (in: hFindFile=0x34220e0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.143] FindNextFileW (in: hFindFile=0x34220e0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0050.143] FindClose (in: hFindFile=0x34220e0 | out: hFindFile=0x34220e0) returned 1 [0050.143] GetProcessHeap () returned 0x350000 [0050.143] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3423088 | out: hHeap=0x350000) returned 1 [0050.143] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 0 [0050.143] FindClose (in: hFindFile=0x34220a0 | out: hFindFile=0x34220a0) returned 1 [0050.143] GetProcessHeap () returned 0x350000 [0050.143] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3f8600 | out: hHeap=0x350000) returned 1 [0050.143] FindNextFileW (in: hFindFile=0x375268, lpFindFileData=0x2dbfaf0 | out: lpFindFileData=0x2dbfaf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe20d0440, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe20d0440, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0050.143] GetProcessHeap () returned 0x350000 [0050.143] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3f8600 [0050.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe20d0440, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe20d0440, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34220a0 [0050.144] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe20d0440, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe20d0440, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.144] FindNextFileW (in: hFindFile=0x34220a0, lpFindFileData=0x2dbf868 | out: lpFindFileData=0x2dbf868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdc08eaa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc08eaa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0050.144] GetProcessHeap () returned 0x350000 [0050.144] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3423088 [0050.144] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdc08eaa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc08eaa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34220e0 [0050.144] FindNextFileW (in: hFindFile=0x34220e0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdc08eaa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc08eaa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.144] FindNextFileW (in: hFindFile=0x34220e0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0050.144] GetProcessHeap () returned 0x350000 [0050.144] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3400068 [0050.145] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422160 [0050.145] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.145] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0050.145] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0050.145] FindClose (in: hFindFile=0x3422160 | out: hFindFile=0x3422160) returned 1 [0050.145] GetProcessHeap () returned 0x350000 [0050.145] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3400068 | out: hHeap=0x350000) returned 1 [0050.145] FindNextFileW (in: hFindFile=0x34220e0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e265e90, ftCreationTime.dwHighDateTime=0x1d5a725, ftLastAccessTime.dwLowDateTime=0x9bf178c0, ftLastAccessTime.dwHighDateTime=0x1d5b930, ftLastWriteTime.dwLowDateTime=0x9bf178c0, ftLastWriteTime.dwHighDateTime=0x1d5b930, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="gmailnotifierpro.exe", cAlternateFileName="GMAILN~1.EXE")) returned 1 [0050.145] FindNextFileW (in: hFindFile=0x34220e0, lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0050.145] GetProcessHeap () returned 0x350000 [0050.145] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x3400068 [0050.145] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422160 [0050.233] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.233] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0050.233] GetProcessHeap () returned 0x350000 [0050.233] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34660a0 [0050.234] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422220 [0050.234] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.234] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0050.234] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0050.234] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0050.234] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 0 [0050.235] FindClose (in: hFindFile=0x3422220 | out: hFindFile=0x3422220) returned 1 [0050.235] GetProcessHeap () returned 0x350000 [0050.235] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0050.235] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0050.235] GetProcessHeap () returned 0x350000 [0050.235] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34660a0 [0050.235] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422220 [0050.235] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.235] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0050.235] GetProcessHeap () returned 0x350000 [0050.235] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34760a8 [0050.236] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0050.236] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.236] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0050.236] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 0 [0050.236] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0050.236] GetProcessHeap () returned 0x350000 [0050.236] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34760a8 | out: hHeap=0x350000) returned 1 [0050.236] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0050.236] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0050.237] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="eqnedt32.exe.manifest", cAlternateFileName="EQNEDT~1.MAN")) returned 1 [0050.237] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0050.237] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0050.237] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 0 [0050.237] FindClose (in: hFindFile=0x3422220 | out: hFindFile=0x3422220) returned 1 [0050.237] GetProcessHeap () returned 0x350000 [0050.237] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0050.237] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0050.237] GetProcessHeap () returned 0x350000 [0050.237] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34660a0 [0050.237] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422220 [0050.238] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.238] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0050.238] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 0 [0050.238] FindClose (in: hFindFile=0x3422220 | out: hFindFile=0x3422220) returned 1 [0050.238] GetProcessHeap () returned 0x350000 [0050.238] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0050.238] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0050.238] GetProcessHeap () returned 0x350000 [0050.238] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34660a0 [0050.238] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422220 [0050.240] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.240] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0050.240] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x0, dwReserved1=0x0, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0050.240] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x0, dwReserved1=0x0, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0050.240] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0050.240] FindNextFileW (in: hFindFile=0x3422220, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0050.240] FindClose (in: hFindFile=0x3422220 | out: hFindFile=0x3422220) returned 1 [0050.240] GetProcessHeap () returned 0x350000 [0050.240] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0050.240] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0050.241] GetProcessHeap () returned 0x350000 [0050.241] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34660a0 [0050.241] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0052.378] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.378] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0052.378] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1 [0052.379] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1 [0052.379] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1 [0052.379] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1 [0052.379] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1 [0052.379] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.CGM", cAlternateFileName="")) returned 1 [0052.379] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EPS", cAlternateFileName="")) returned 1 [0052.380] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GIF", cAlternateFileName="")) returned 1 [0052.380] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.JPG", cAlternateFileName="")) returned 1 [0052.380] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.PNG", cAlternateFileName="")) returned 1 [0052.380] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WPG", cAlternateFileName="")) returned 1 [0052.380] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1 [0052.380] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1 [0052.381] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1 [0052.381] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0 [0052.381] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0052.382] GetProcessHeap () returned 0x350000 [0052.382] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0052.382] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0052.382] GetProcessHeap () returned 0x350000 [0052.382] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34660a0 [0052.383] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0052.383] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.383] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0052.383] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0052.383] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0052.383] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 0 [0052.383] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0052.383] GetProcessHeap () returned 0x350000 [0052.383] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0052.384] FindNextFileW (in: hFindFile=0x3422160, lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0052.384] GetProcessHeap () returned 0x350000 [0052.384] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34660a0 [0052.384] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0052.424] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.425] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0052.425] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0052.425] GetProcessHeap () returned 0x350000 [0052.425] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34880b0 [0052.425] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.425] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.425] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.426] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.426] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.426] GetProcessHeap () returned 0x350000 [0052.426] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.426] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0052.426] GetProcessHeap () returned 0x350000 [0052.426] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34880b0 [0052.426] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.427] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.427] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.427] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.427] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.427] GetProcessHeap () returned 0x350000 [0052.427] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.427] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0052.427] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0052.428] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0052.428] GetProcessHeap () returned 0x350000 [0052.428] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34880b0 [0052.428] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.428] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.428] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.428] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.428] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.429] GetProcessHeap () returned 0x350000 [0052.429] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.429] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0052.429] GetProcessHeap () returned 0x350000 [0052.429] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34880b0 [0052.429] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.429] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.429] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.429] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.429] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.429] GetProcessHeap () returned 0x350000 [0052.429] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.429] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0052.430] GetProcessHeap () returned 0x350000 [0052.430] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34880b0 [0052.430] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.430] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.430] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.430] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.430] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.431] GetProcessHeap () returned 0x350000 [0052.431] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.431] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0052.431] GetProcessHeap () returned 0x350000 [0052.431] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34880b0 [0052.431] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.431] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.431] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.432] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.432] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.432] GetProcessHeap () returned 0x350000 [0052.432] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.432] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0052.432] GetProcessHeap () returned 0x350000 [0052.433] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34880b0 [0052.433] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.434] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.434] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0052.434] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0052.434] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0052.434] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0052.434] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0052.434] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0052.435] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0052.435] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0052.435] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0052.435] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0052.435] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0052.435] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0052.435] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0052.435] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0052.436] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0052.436] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0052.436] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0052.436] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0052.436] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0052.436] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0052.436] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0052.436] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0052.437] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.437] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0052.437] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0052.437] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.438] GetProcessHeap () returned 0x350000 [0052.438] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.438] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0052.438] GetProcessHeap () returned 0x350000 [0052.438] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34880b0 [0052.438] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.439] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.439] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.439] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.439] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.439] GetProcessHeap () returned 0x350000 [0052.439] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.440] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0052.440] GetProcessHeap () returned 0x350000 [0052.440] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34880b0 [0052.440] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.440] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.441] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.441] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.441] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.441] GetProcessHeap () returned 0x350000 [0052.441] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.441] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0052.441] GetProcessHeap () returned 0x350000 [0052.441] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34880b0 [0052.441] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.442] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.442] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.442] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.442] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.442] GetProcessHeap () returned 0x350000 [0052.442] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.442] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0052.443] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0052.443] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0052.443] GetProcessHeap () returned 0x350000 [0052.443] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34880b0 [0052.443] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.443] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.444] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.444] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.444] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.444] GetProcessHeap () returned 0x350000 [0052.444] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.444] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0052.444] GetProcessHeap () returned 0x350000 [0052.444] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34880b0 [0052.444] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.445] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.445] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0052.445] GetProcessHeap () returned 0x350000 [0052.445] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34980b8 [0052.446] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0052.446] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.446] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0052.446] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0052.446] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0052.446] GetProcessHeap () returned 0x350000 [0052.446] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34980b8 | out: hHeap=0x350000) returned 1 [0052.447] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0052.447] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0052.447] GetProcessHeap () returned 0x350000 [0052.447] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34980b8 [0052.447] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0052.447] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.447] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0052.447] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0052.447] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0052.448] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0052.448] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0052.448] GetProcessHeap () returned 0x350000 [0052.448] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34980b8 | out: hHeap=0x350000) returned 1 [0052.448] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0052.448] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0052.448] GetProcessHeap () returned 0x350000 [0052.448] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34980b8 [0052.448] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0052.449] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.449] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0052.450] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0052.450] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0052.450] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0052.450] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0052.450] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0052.450] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0052.450] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0052.450] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0052.451] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0052.451] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0052.451] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0052.451] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0052.451] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0052.451] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0052.452] GetProcessHeap () returned 0x350000 [0052.452] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34980b8 | out: hHeap=0x350000) returned 1 [0052.452] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0052.452] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers", cAlternateFileName="")) returned 1 [0052.452] GetProcessHeap () returned 0x350000 [0052.452] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34980b8 [0052.452] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0052.453] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.453] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0052.453] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 0 [0052.453] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0052.453] GetProcessHeap () returned 0x350000 [0052.453] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34980b8 | out: hHeap=0x350000) returned 1 [0052.453] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0052.453] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0052.454] GetProcessHeap () returned 0x350000 [0052.454] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34980b8 [0052.454] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0052.454] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.454] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0052.454] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0052.454] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0052.454] GetProcessHeap () returned 0x350000 [0052.454] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34980b8 | out: hHeap=0x350000) returned 1 [0052.454] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0052.455] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0052.455] GetProcessHeap () returned 0x350000 [0052.455] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34980b8 [0052.455] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0052.456] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.456] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0052.456] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0052.456] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0052.456] GetProcessHeap () returned 0x350000 [0052.456] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34980b8 | out: hHeap=0x350000) returned 1 [0052.456] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0052.456] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0052.457] GetProcessHeap () returned 0x350000 [0052.457] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34980b8 [0052.457] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0052.457] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.457] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0052.457] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0052.457] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0052.457] GetProcessHeap () returned 0x350000 [0052.457] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34980b8 | out: hHeap=0x350000) returned 1 [0052.457] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0052.458] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0052.458] GetProcessHeap () returned 0x350000 [0052.458] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34980b8 [0052.458] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0052.458] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.458] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0052.458] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0052.458] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0052.458] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0052.459] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0052.459] GetProcessHeap () returned 0x350000 [0052.459] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34980b8 | out: hHeap=0x350000) returned 1 [0052.459] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0052.459] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="web", cAlternateFileName="")) returned 1 [0052.459] GetProcessHeap () returned 0x350000 [0052.459] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34980b8 [0052.459] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0052.459] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.459] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0052.460] FindNextFileW (in: hFindFile=0x34222e0, lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 0 [0052.460] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0052.460] GetProcessHeap () returned 0x350000 [0052.460] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34980b8 | out: hHeap=0x350000) returned 1 [0052.460] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 1 [0052.460] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 0 [0052.460] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.460] GetProcessHeap () returned 0x350000 [0052.460] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.460] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0052.460] GetProcessHeap () returned 0x350000 [0052.461] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34880b0 [0052.461] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.461] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.461] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.461] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.461] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.461] GetProcessHeap () returned 0x350000 [0052.461] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.461] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0052.461] GetProcessHeap () returned 0x350000 [0052.461] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34880b0 [0052.462] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.462] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.462] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.462] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.462] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.462] GetProcessHeap () returned 0x350000 [0052.462] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.462] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0052.462] GetProcessHeap () returned 0x350000 [0052.462] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34880b0 [0052.462] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.463] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.463] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.463] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.463] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.463] GetProcessHeap () returned 0x350000 [0052.463] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.463] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0052.463] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0052.463] GetProcessHeap () returned 0x350000 [0052.463] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34880b0 [0052.464] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.464] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.464] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0052.464] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.464] GetProcessHeap () returned 0x350000 [0052.464] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.464] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0052.464] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0052.464] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0052.464] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1 [0052.465] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1 [0052.465] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0052.465] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0052.465] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0052.465] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0052.465] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1 [0052.465] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0052.466] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0052.466] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0052.466] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0052.466] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0052.466] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0052.466] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0052.466] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0052.467] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0052.467] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0052.467] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0052.467] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0052.467] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0052.467] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0052.468] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0052.468] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0052.468] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0052.468] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0052.468] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0052.468] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0052.468] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0052.469] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0052.469] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0052.469] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0052.469] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0052.469] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0052.469] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0052.469] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0052.470] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0052.470] GetProcessHeap () returned 0x350000 [0052.470] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34880b0 [0052.470] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.470] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.470] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.470] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.471] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.753] GetProcessHeap () returned 0x350000 [0052.753] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.754] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0052.754] GetProcessHeap () returned 0x350000 [0052.754] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34880b0 [0052.754] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.754] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.754] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.755] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.755] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.755] GetProcessHeap () returned 0x350000 [0052.755] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.755] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0052.755] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0052.755] GetProcessHeap () returned 0x350000 [0052.755] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34880b0 [0052.755] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.756] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.756] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.756] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.756] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.756] GetProcessHeap () returned 0x350000 [0052.756] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.756] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0052.756] GetProcessHeap () returned 0x350000 [0052.756] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34880b0 [0052.756] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.757] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.757] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.757] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.757] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.757] GetProcessHeap () returned 0x350000 [0052.757] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.757] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0052.757] GetProcessHeap () returned 0x350000 [0052.757] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34880b0 [0052.757] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.757] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.757] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.758] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.758] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.758] GetProcessHeap () returned 0x350000 [0052.758] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.758] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0052.758] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472c5956, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0xa4945a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x9fcc4285, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0052.758] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12394d3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12394d3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa125f634, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0052.758] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad46e47, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5ad46e47, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x344e2230, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x609c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0052.758] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66c00201, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x66c00201, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x34eb4c90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0052.759] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901e133e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x901e133e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x353c2bb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x105a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0052.759] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0052.759] GetProcessHeap () returned 0x350000 [0052.759] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34880b0 [0052.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.759] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.759] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.759] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0052.759] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.759] GetProcessHeap () returned 0x350000 [0052.759] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.760] FindNextFileW (in: hFindFile=0x3422260, lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0052.760] GetProcessHeap () returned 0x350000 [0052.760] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x34880b0 [0052.760] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.760] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.760] FindNextFileW (in: hFindFile=0x34222a0, lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0052.761] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.761] GetProcessHeap () returned 0x350000 [0052.761] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.761] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.763] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.763] GetProcessHeap () returned 0x350000 [0052.763] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.764] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.764] GetProcessHeap () returned 0x350000 [0052.764] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.764] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.765] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.765] GetProcessHeap () returned 0x350000 [0052.765] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.765] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.766] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.766] GetProcessHeap () returned 0x350000 [0052.766] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.768] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.768] GetProcessHeap () returned 0x350000 [0052.768] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.768] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.769] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.771] GetProcessHeap () returned 0x350000 [0052.771] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.771] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.772] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.772] GetProcessHeap () returned 0x350000 [0052.772] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.772] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.773] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.773] GetProcessHeap () returned 0x350000 [0052.773] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.773] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.774] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.775] GetProcessHeap () returned 0x350000 [0052.775] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.775] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.775] GetProcessHeap () returned 0x350000 [0052.775] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.776] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.776] GetProcessHeap () returned 0x350000 [0052.776] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.777] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.777] GetProcessHeap () returned 0x350000 [0052.777] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.779] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.779] GetProcessHeap () returned 0x350000 [0052.779] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.779] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.780] GetProcessHeap () returned 0x350000 [0052.780] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.780] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0052.780] GetProcessHeap () returned 0x350000 [0052.780] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0052.780] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0052.781] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0052.781] GetProcessHeap () returned 0x350000 [0052.782] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0052.782] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0052.782] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.783] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.783] GetProcessHeap () returned 0x350000 [0052.783] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.783] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0052.783] GetProcessHeap () returned 0x350000 [0052.784] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0052.784] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0052.784] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.786] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.787] GetProcessHeap () returned 0x350000 [0052.787] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.787] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222a0 [0052.788] FindClose (in: hFindFile=0x34222a0 | out: hFindFile=0x34222a0) returned 1 [0052.789] GetProcessHeap () returned 0x350000 [0052.789] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0052.789] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0053.094] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.096] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.097] GetProcessHeap () returned 0x350000 [0053.097] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34a80c0 | out: hHeap=0x350000) returned 1 [0053.098] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.098] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.098] GetProcessHeap () returned 0x350000 [0053.098] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34a80c0 | out: hHeap=0x350000) returned 1 [0053.098] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.098] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.098] GetProcessHeap () returned 0x350000 [0053.098] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34a80c0 | out: hHeap=0x350000) returned 1 [0053.098] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.099] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.099] GetProcessHeap () returned 0x350000 [0053.099] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34a80c0 | out: hHeap=0x350000) returned 1 [0053.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.100] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.101] GetProcessHeap () returned 0x350000 [0053.101] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34a80c0 | out: hHeap=0x350000) returned 1 [0053.101] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.101] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.101] GetProcessHeap () returned 0x350000 [0053.101] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34a80c0 | out: hHeap=0x350000) returned 1 [0053.101] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.102] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.102] GetProcessHeap () returned 0x350000 [0053.102] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34a80c0 | out: hHeap=0x350000) returned 1 [0053.102] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.102] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.102] GetProcessHeap () returned 0x350000 [0053.102] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34a80c0 | out: hHeap=0x350000) returned 1 [0053.102] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.298] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.298] GetProcessHeap () returned 0x350000 [0053.298] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34a80c0 | out: hHeap=0x350000) returned 1 [0053.298] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.299] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.300] GetProcessHeap () returned 0x350000 [0053.300] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34a80c0 | out: hHeap=0x350000) returned 1 [0053.300] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.310] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.310] GetProcessHeap () returned 0x350000 [0053.310] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34a80c0 | out: hHeap=0x350000) returned 1 [0053.310] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.312] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.312] GetProcessHeap () returned 0x350000 [0053.312] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34a80c0 | out: hHeap=0x350000) returned 1 [0053.312] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.314] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.314] GetProcessHeap () returned 0x350000 [0053.314] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34a80c0 | out: hHeap=0x350000) returned 1 [0053.314] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.315] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.315] GetProcessHeap () returned 0x350000 [0053.315] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34a80c0 | out: hHeap=0x350000) returned 1 [0053.315] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.316] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.316] GetProcessHeap () returned 0x350000 [0053.316] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34a80c0 | out: hHeap=0x350000) returned 1 [0053.316] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.317] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.317] GetProcessHeap () returned 0x350000 [0053.317] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34a80c0 | out: hHeap=0x350000) returned 1 [0053.317] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.318] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.318] GetProcessHeap () returned 0x350000 [0053.318] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34a80c0 | out: hHeap=0x350000) returned 1 [0053.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.319] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.319] GetProcessHeap () returned 0x350000 [0053.319] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34a80c0 | out: hHeap=0x350000) returned 1 [0053.319] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.321] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.321] GetProcessHeap () returned 0x350000 [0053.321] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34a80c0 | out: hHeap=0x350000) returned 1 [0053.321] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.321] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.321] GetProcessHeap () returned 0x350000 [0053.321] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34a80c0 | out: hHeap=0x350000) returned 1 [0053.321] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.323] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.323] GetProcessHeap () returned 0x350000 [0053.323] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34a80c0 | out: hHeap=0x350000) returned 1 [0053.323] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0053.323] GetProcessHeap () returned 0x350000 [0053.323] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0053.323] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0053.323] GetProcessHeap () returned 0x350000 [0053.323] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0053.323] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0053.324] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0053.326] GetProcessHeap () returned 0x350000 [0053.326] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0053.326] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0053.327] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0053.327] GetProcessHeap () returned 0x350000 [0053.327] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0053.327] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0053.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.331] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.331] GetProcessHeap () returned 0x350000 [0053.331] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0053.331] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.332] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422360 [0053.332] FindClose (in: hFindFile=0x3422360 | out: hFindFile=0x3422360) returned 1 [0053.332] GetProcessHeap () returned 0x350000 [0053.332] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34a80c0 | out: hHeap=0x350000) returned 1 [0053.332] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.332] GetProcessHeap () returned 0x350000 [0053.332] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0053.332] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0053.332] GetProcessHeap () returned 0x350000 [0053.332] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0053.333] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0053.334] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0053.334] GetProcessHeap () returned 0x350000 [0053.334] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0053.334] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0053.337] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0053.338] GetProcessHeap () returned 0x350000 [0053.338] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0053.338] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0053.339] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.339] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.339] GetProcessHeap () returned 0x350000 [0053.339] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0053.339] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0053.339] GetProcessHeap () returned 0x350000 [0053.339] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0053.339] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0053.344] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.344] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.344] GetProcessHeap () returned 0x350000 [0053.344] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0053.344] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.345] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.345] GetProcessHeap () returned 0x350000 [0053.345] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0053.345] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.346] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.346] GetProcessHeap () returned 0x350000 [0053.346] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0053.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.518] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.518] GetProcessHeap () returned 0x350000 [0053.518] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0053.518] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.519] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.519] GetProcessHeap () returned 0x350000 [0053.519] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0053.519] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0053.814] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0053.814] GetProcessHeap () returned 0x350000 [0053.814] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0053.814] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0054.096] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0054.096] GetProcessHeap () returned 0x350000 [0054.096] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0054.096] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0055.068] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0055.068] GetProcessHeap () returned 0x350000 [0055.068] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0055.068] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0055.220] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0055.220] GetProcessHeap () returned 0x350000 [0055.220] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0055.220] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0055.452] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0055.452] GetProcessHeap () returned 0x350000 [0055.452] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0055.452] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0058.206] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0058.206] GetProcessHeap () returned 0x350000 [0058.206] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0058.206] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0058.950] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0058.951] GetProcessHeap () returned 0x350000 [0058.951] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0058.951] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0058.951] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0058.951] GetProcessHeap () returned 0x350000 [0058.951] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0058.951] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0059.369] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0059.369] GetProcessHeap () returned 0x350000 [0059.369] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0059.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0059.614] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0059.614] GetProcessHeap () returned 0x350000 [0059.614] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0059.614] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0059.620] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0059.620] GetProcessHeap () returned 0x350000 [0059.620] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0059.620] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0059.627] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0059.627] GetProcessHeap () returned 0x350000 [0059.627] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0059.627] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0059.628] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0059.628] GetProcessHeap () returned 0x350000 [0059.628] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0059.628] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0059.629] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0059.629] GetProcessHeap () returned 0x350000 [0059.629] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0059.629] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0059.630] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0059.630] GetProcessHeap () returned 0x350000 [0059.630] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0059.630] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0059.631] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0059.631] GetProcessHeap () returned 0x350000 [0059.631] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0059.631] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0059.633] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0059.633] GetProcessHeap () returned 0x350000 [0059.633] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0059.633] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0059.650] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0059.651] GetProcessHeap () returned 0x350000 [0059.651] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0059.651] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0059.664] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0059.664] GetProcessHeap () returned 0x350000 [0059.664] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0059.664] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0059.665] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0059.665] GetProcessHeap () returned 0x350000 [0059.665] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0059.665] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0059.666] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0059.666] GetProcessHeap () returned 0x350000 [0059.666] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0059.666] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0059.667] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0059.667] GetProcessHeap () returned 0x350000 [0059.667] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0059.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0059.667] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0059.667] GetProcessHeap () returned 0x350000 [0059.667] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0059.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.303] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.303] GetProcessHeap () returned 0x350000 [0060.303] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.303] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.334] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.335] GetProcessHeap () returned 0x350000 [0060.335] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.336] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.336] GetProcessHeap () returned 0x350000 [0060.336] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.336] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.336] GetProcessHeap () returned 0x350000 [0060.337] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.337] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.338] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.338] GetProcessHeap () returned 0x350000 [0060.338] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.338] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.338] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.339] GetProcessHeap () returned 0x350000 [0060.339] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.339] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.340] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.340] GetProcessHeap () returned 0x350000 [0060.340] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.340] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.340] GetProcessHeap () returned 0x350000 [0060.340] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.341] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.341] GetProcessHeap () returned 0x350000 [0060.342] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.342] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.343] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.343] GetProcessHeap () returned 0x350000 [0060.343] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.343] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.344] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.344] GetProcessHeap () returned 0x350000 [0060.344] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.344] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.345] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.345] GetProcessHeap () returned 0x350000 [0060.345] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.345] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.346] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.347] GetProcessHeap () returned 0x350000 [0060.347] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.347] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.347] GetProcessHeap () returned 0x350000 [0060.347] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.348] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.348] GetProcessHeap () returned 0x350000 [0060.348] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.348] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.352] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.352] GetProcessHeap () returned 0x350000 [0060.352] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.352] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.352] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.353] GetProcessHeap () returned 0x350000 [0060.353] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.353] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0060.353] GetProcessHeap () returned 0x350000 [0060.353] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0060.353] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0060.355] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.356] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.357] GetProcessHeap () returned 0x350000 [0060.357] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.357] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.358] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.358] GetProcessHeap () returned 0x350000 [0060.358] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.358] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.358] GetProcessHeap () returned 0x350000 [0060.358] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.359] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.359] GetProcessHeap () returned 0x350000 [0060.359] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.359] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.360] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.360] GetProcessHeap () returned 0x350000 [0060.360] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.360] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.361] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.361] GetProcessHeap () returned 0x350000 [0060.361] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.361] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0060.362] GetProcessHeap () returned 0x350000 [0060.362] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0060.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0060.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.363] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.364] GetProcessHeap () returned 0x350000 [0060.364] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.364] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0060.364] GetProcessHeap () returned 0x350000 [0060.364] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0060.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0060.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422360 [0060.368] FindClose (in: hFindFile=0x3422360 | out: hFindFile=0x3422360) returned 1 [0060.369] GetProcessHeap () returned 0x350000 [0060.369] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34a80c0 | out: hHeap=0x350000) returned 1 [0060.369] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.369] GetProcessHeap () returned 0x350000 [0060.369] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.369] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0060.370] GetProcessHeap () returned 0x350000 [0060.370] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0060.370] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0060.371] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0060.371] GetProcessHeap () returned 0x350000 [0060.371] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0060.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0060.372] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0060.372] GetProcessHeap () returned 0x350000 [0060.372] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0060.372] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0060.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.737] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.739] GetProcessHeap () returned 0x350000 [0060.739] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.739] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0060.739] GetProcessHeap () returned 0x350000 [0060.739] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0060.739] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0060.959] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.962] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422360 [0060.969] FindClose (in: hFindFile=0x3422360 | out: hFindFile=0x3422360) returned 1 [0060.971] GetProcessHeap () returned 0x350000 [0060.971] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34a80c0 | out: hHeap=0x350000) returned 1 [0060.971] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.971] GetProcessHeap () returned 0x350000 [0060.971] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.971] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0060.972] GetProcessHeap () returned 0x350000 [0060.972] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0060.972] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0060.973] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.973] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.973] GetProcessHeap () returned 0x350000 [0060.973] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.974] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0060.974] GetProcessHeap () returned 0x350000 [0060.974] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0060.974] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0060.975] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.975] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422360 [0060.977] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*", lpFindFileData=0x2dbe938 | out: lpFindFileData=0x2dbe938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34223a0 [0060.977] FindClose (in: hFindFile=0x34223a0 | out: hFindFile=0x34223a0) returned 1 [0060.977] GetProcessHeap () returned 0x350000 [0060.977] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3700048 | out: hHeap=0x350000) returned 1 [0060.978] FindClose (in: hFindFile=0x3422360 | out: hFindFile=0x3422360) returned 1 [0060.978] GetProcessHeap () returned 0x350000 [0060.978] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34a80c0 | out: hHeap=0x350000) returned 1 [0060.978] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.978] GetProcessHeap () returned 0x350000 [0060.978] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.978] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0060.978] GetProcessHeap () returned 0x350000 [0060.978] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0060.980] FindClose (in: hFindFile=0x3422160 | out: hFindFile=0x3422160) returned 1 [0060.980] GetProcessHeap () returned 0x350000 [0060.980] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3400068 | out: hHeap=0x350000) returned 1 [0060.980] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422160 [0060.981] FindClose (in: hFindFile=0x3422160 | out: hFindFile=0x3422160) returned 1 [0060.981] GetProcessHeap () returned 0x350000 [0060.981] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0060.981] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422160 [0060.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0060.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0060.983] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422360 [0060.984] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", lpFindFileData=0x2dbe938 | out: lpFindFileData=0x2dbe938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34223a0 [0060.984] FindClose (in: hFindFile=0x34223a0 | out: hFindFile=0x34223a0) returned 1 [0060.984] GetProcessHeap () returned 0x350000 [0060.984] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34a80c0 | out: hHeap=0x350000) returned 1 [0060.984] FindClose (in: hFindFile=0x3422360 | out: hFindFile=0x3422360) returned 1 [0060.984] GetProcessHeap () returned 0x350000 [0060.984] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3700048 | out: hHeap=0x350000) returned 1 [0060.984] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0060.985] GetProcessHeap () returned 0x350000 [0060.985] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3400068 | out: hHeap=0x350000) returned 1 [0060.985] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0060.985] GetProcessHeap () returned 0x350000 [0060.985] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0060.986] FindClose (in: hFindFile=0x3422160 | out: hFindFile=0x3422160) returned 1 [0060.986] GetProcessHeap () returned 0x350000 [0060.987] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0060.987] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422160 [0060.989] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0061.254] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0061.254] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0061.254] GetProcessHeap () returned 0x350000 [0061.254] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3700048 | out: hHeap=0x350000) returned 1 [0061.254] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0061.254] GetProcessHeap () returned 0x350000 [0061.254] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0061.254] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0061.255] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0061.255] GetProcessHeap () returned 0x350000 [0061.255] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3700048 | out: hHeap=0x350000) returned 1 [0061.255] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0061.259] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0061.262] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0061.263] GetProcessHeap () returned 0x350000 [0061.263] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0061.263] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0061.263] GetProcessHeap () returned 0x350000 [0061.263] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3700048 | out: hHeap=0x350000) returned 1 [0061.265] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0061.266] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0061.267] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0061.267] GetProcessHeap () returned 0x350000 [0061.267] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0061.267] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0061.267] GetProcessHeap () returned 0x350000 [0061.267] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3700048 | out: hHeap=0x350000) returned 1 [0061.269] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0061.272] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0061.272] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0061.272] GetProcessHeap () returned 0x350000 [0061.272] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0061.272] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0061.272] GetProcessHeap () returned 0x350000 [0061.272] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3700048 | out: hHeap=0x350000) returned 1 [0061.274] FindClose (in: hFindFile=0x3422160 | out: hFindFile=0x3422160) returned 1 [0061.274] GetProcessHeap () returned 0x350000 [0061.274] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0061.274] FindClose (in: hFindFile=0x34220e0 | out: hFindFile=0x34220e0) returned 1 [0061.274] GetProcessHeap () returned 0x350000 [0061.274] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3423088 | out: hHeap=0x350000) returned 1 [0061.274] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdadf5ec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdadf5ec0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34220e0 [0061.274] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422160 [0061.275] FindClose (in: hFindFile=0x3422160 | out: hFindFile=0x3422160) returned 1 [0061.275] GetProcessHeap () returned 0x350000 [0061.275] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3423088 | out: hHeap=0x350000) returned 1 [0061.275] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422160 [0061.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0061.281] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0061.284] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0061.285] GetProcessHeap () returned 0x350000 [0061.285] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0061.285] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0061.287] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0061.288] GetProcessHeap () returned 0x350000 [0061.288] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0061.288] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0061.457] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0061.458] GetProcessHeap () returned 0x350000 [0061.458] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0061.458] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0061.636] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0061.637] GetProcessHeap () returned 0x350000 [0061.637] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0061.637] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0061.831] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0061.832] GetProcessHeap () returned 0x350000 [0061.832] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0061.833] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0061.925] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0061.926] GetProcessHeap () returned 0x350000 [0061.926] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0062.112] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0062.249] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0062.250] GetProcessHeap () returned 0x350000 [0062.250] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0062.250] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0062.363] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0062.364] GetProcessHeap () returned 0x350000 [0062.364] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0062.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0062.502] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0062.503] GetProcessHeap () returned 0x350000 [0062.503] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0062.503] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0062.595] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0062.596] GetProcessHeap () returned 0x350000 [0062.596] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0062.596] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0062.690] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0062.691] GetProcessHeap () returned 0x350000 [0062.691] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0062.691] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0062.739] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0062.740] GetProcessHeap () returned 0x350000 [0062.740] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0062.740] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0062.977] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0062.977] GetProcessHeap () returned 0x350000 [0062.977] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0062.977] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0063.100] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0063.101] GetProcessHeap () returned 0x350000 [0063.101] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0063.101] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0063.641] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0063.642] GetProcessHeap () returned 0x350000 [0063.642] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0063.643] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0065.752] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0065.754] GetProcessHeap () returned 0x350000 [0065.754] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3400068 | out: hHeap=0x350000) returned 1 [0065.754] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0066.262] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0066.262] GetProcessHeap () returned 0x350000 [0066.262] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3400068 | out: hHeap=0x350000) returned 1 [0066.262] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0066.765] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0066.766] GetProcessHeap () returned 0x350000 [0066.766] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3400068 | out: hHeap=0x350000) returned 1 [0066.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0066.766] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0066.766] GetProcessHeap () returned 0x350000 [0066.766] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3400068 | out: hHeap=0x350000) returned 1 [0066.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0067.434] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0067.435] GetProcessHeap () returned 0x350000 [0067.435] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3400068 | out: hHeap=0x350000) returned 1 [0067.435] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0067.435] GetProcessHeap () returned 0x350000 [0067.435] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3700048 | out: hHeap=0x350000) returned 1 [0067.435] FindClose (in: hFindFile=0x3422160 | out: hFindFile=0x3422160) returned 1 [0067.435] GetProcessHeap () returned 0x350000 [0067.435] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3423088 | out: hHeap=0x350000) returned 1 [0067.435] FindClose (in: hFindFile=0x34220e0 | out: hFindFile=0x34220e0) returned 1 [0067.435] GetProcessHeap () returned 0x350000 [0067.435] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0067.480] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdc1e5700, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc1e5700, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34220e0 [0067.481] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422160 [0067.482] FindClose (in: hFindFile=0x3422160 | out: hFindFile=0x3422160) returned 1 [0067.483] GetProcessHeap () returned 0x350000 [0067.483] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3423088 | out: hHeap=0x350000) returned 1 [0067.483] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422160 [0067.484] FindClose (in: hFindFile=0x3422160 | out: hFindFile=0x3422160) returned 1 [0067.484] GetProcessHeap () returned 0x350000 [0067.484] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3423088 | out: hHeap=0x350000) returned 1 [0067.484] FindClose (in: hFindFile=0x34220e0 | out: hFindFile=0x34220e0) returned 1 [0067.484] GetProcessHeap () returned 0x350000 [0067.484] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0067.484] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdc20b860, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc20b860, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34220e0 [0067.484] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422160 [0067.485] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0067.487] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0067.490] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0067.491] GetProcessHeap () returned 0x350000 [0067.491] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3700048 | out: hHeap=0x350000) returned 1 [0067.491] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*", lpFindFileData=0x2dbee48 | out: lpFindFileData=0x2dbee48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422260 [0067.492] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*", lpFindFileData=0x2dbebc0 | out: lpFindFileData=0x2dbebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422320 [0067.493] FindClose (in: hFindFile=0x3422320 | out: hFindFile=0x3422320) returned 1 [0067.493] GetProcessHeap () returned 0x350000 [0067.493] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34880b0 | out: hHeap=0x350000) returned 1 [0067.493] FindClose (in: hFindFile=0x3422260 | out: hFindFile=0x3422260) returned 1 [0067.493] GetProcessHeap () returned 0x350000 [0067.493] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3700048 | out: hHeap=0x350000) returned 1 [0067.495] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0067.495] GetProcessHeap () returned 0x350000 [0067.495] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3400068 | out: hHeap=0x350000) returned 1 [0067.495] FindClose (in: hFindFile=0x3422160 | out: hFindFile=0x3422160) returned 1 [0067.495] GetProcessHeap () returned 0x350000 [0067.495] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3423088 | out: hHeap=0x350000) returned 1 [0067.495] FindClose (in: hFindFile=0x34220e0 | out: hFindFile=0x34220e0) returned 1 [0067.496] GetProcessHeap () returned 0x350000 [0067.496] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x34660a0 | out: hHeap=0x350000) returned 1 [0067.496] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x2dbf5e0 | out: lpFindFileData=0x2dbf5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdc1bf5a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc1bf5a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34220e0 [0067.496] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\*", lpFindFileData=0x2dbf358 | out: lpFindFileData=0x2dbf358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3422160 [0067.500] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0070.547] FindClose (in: hFindFile=0x34222e0 | out: hFindFile=0x34222e0) returned 1 [0070.550] GetProcessHeap () returned 0x350000 [0070.550] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x3400068 | out: hHeap=0x350000) returned 1 [0070.551] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*", lpFindFileData=0x2dbf0d0 | out: lpFindFileData=0x2dbf0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34222e0 [0072.708] FindFirstFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*", lpFindFileData=0x2dbee48) Thread: id = 22 os_tid = 0x6f4 [0048.866] GetProcessHeap () returned 0x350000 [0048.866] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x408608 [0048.866] GetProcessHeap () returned 0x350000 [0048.866] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x418610 [0048.867] GetProcessHeap () returned 0x350000 [0048.867] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x28) returned 0x3752a8 [0048.867] GetProcessHeap () returned 0x350000 [0048.867] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x110102) returned 0x3180020 [0048.868] GetProcessHeap () returned 0x350000 [0048.868] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x50) returned 0x36f6d8 [0048.869] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0048.869] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0048.869] Wow64DisableWow64FsRedirection (in: OldValue=0x2c3f80c | out: OldValue=0x2c3f80c*=0x0) returned 1 [0048.869] GetProcessHeap () returned 0x350000 [0048.869] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36f6d8 | out: hHeap=0x350000) returned 1 [0048.870] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0048.870] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=129) returned 1 [0048.870] CloseHandle (hObject=0x164) returned 1 [0048.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0048.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0048.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0048.871] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0048.871] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f780 | out: lpNewFilePointer=0x0) returned 1 [0048.871] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f780 | out: lpNewFilePointer=0x0) returned 1 [0048.871] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x160 [0048.873] ReadFile (in: hFile=0x164, lpBuffer=0x3180020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2c3f78c, lpOverlapped=0x0 | out: lpBuffer=0x3180020*, lpNumberOfBytesRead=0x2c3f78c*=0x81, lpOverlapped=0x0) returned 1 [0048.891] WriteFile (in: hFile=0x160, lpBuffer=0x3180020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x2c3f770, lpOverlapped=0x0 | out: lpBuffer=0x3180020*, lpNumberOfBytesWritten=0x2c3f770*=0x90, lpOverlapped=0x0) returned 1 [0048.893] WriteFile (in: hFile=0x160, lpBuffer=0x3180020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c3f770, lpOverlapped=0x0 | out: lpBuffer=0x3180020*, lpNumberOfBytesWritten=0x2c3f770*=0xf2, lpOverlapped=0x0) returned 1 [0048.893] CloseHandle (hObject=0x164) returned 1 [0048.893] CloseHandle (hObject=0x160) returned 1 [0048.894] DeleteFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0048.896] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.896] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.897] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0049.027] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=0) returned 1 [0049.027] CloseHandle (hObject=0x150) returned 1 [0049.028] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0049.028] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=89168) returned 1 [0049.028] CloseHandle (hObject=0x150) returned 1 [0049.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0049.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0049.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.028] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.029] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0049.029] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=87616) returned 1 [0049.029] CloseHandle (hObject=0x150) returned 1 [0049.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0049.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0049.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.029] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.030] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0049.030] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=91712) returned 1 [0049.030] CloseHandle (hObject=0x150) returned 1 [0049.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0049.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0049.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.030] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.031] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0049.031] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=94800) returned 1 [0049.031] CloseHandle (hObject=0x150) returned 1 [0049.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0049.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0049.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.031] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.032] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0049.032] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=85056) returned 1 [0049.032] CloseHandle (hObject=0x150) returned 1 [0049.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0049.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0049.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.032] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.033] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0049.033] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=43600) returned 1 [0049.033] CloseHandle (hObject=0x150) returned 1 [0049.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0049.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0049.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.033] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.034] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0049.034] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=90192) returned 1 [0049.034] CloseHandle (hObject=0x150) returned 1 [0049.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0049.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0049.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.034] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.035] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0049.035] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=89152) returned 1 [0049.035] CloseHandle (hObject=0x150) returned 1 [0049.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0049.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0049.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.035] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.036] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0049.036] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=3694080) returned 1 [0049.036] CloseHandle (hObject=0x150) returned 1 [0049.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0049.135] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0 [0049.135] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0 [0049.203] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.204] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=3876772) returned 1 [0049.204] CloseHandle (hObject=0x1a8) returned 1 [0049.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0049.204] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0 [0049.204] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0 [0049.205] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.205] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=1984228) returned 1 [0049.205] CloseHandle (hObject=0x1a8) returned 1 [0049.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0049.205] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0 [0049.205] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0 [0049.206] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.206] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=2371360) returned 1 [0049.206] CloseHandle (hObject=0x1a8) returned 1 [0049.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0049.206] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0 [0049.206] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0 [0049.207] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.207] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=47452) returned 1 [0049.207] CloseHandle (hObject=0x1a8) returned 1 [0049.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0049.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0049.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.208] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.208] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.208] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=93248) returned 1 [0049.208] CloseHandle (hObject=0x1a8) returned 1 [0049.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0049.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0049.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.209] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.209] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.209] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=90688) returned 1 [0049.209] CloseHandle (hObject=0x1a8) returned 1 [0049.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0049.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0049.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.210] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.210] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.211] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=90704) returned 1 [0049.211] CloseHandle (hObject=0x1a8) returned 1 [0049.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0049.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0049.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.211] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.211] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.212] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=76352) returned 1 [0049.212] CloseHandle (hObject=0x1a8) returned 1 [0049.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0049.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0049.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.212] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.212] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.213] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=75344) returned 1 [0049.213] CloseHandle (hObject=0x1a8) returned 1 [0049.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0049.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0049.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.213] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.213] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.214] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=485760) returned 1 [0049.214] CloseHandle (hObject=0x1a8) returned 1 [0049.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0049.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0049.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\memtest.exe.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.214] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.215] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.215] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=88144) returned 1 [0049.215] CloseHandle (hObject=0x1a8) returned 1 [0049.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0049.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0049.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.215] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.216] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.216] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=90704) returned 1 [0049.216] CloseHandle (hObject=0x1a8) returned 1 [0049.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0049.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0049.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.216] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.217] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.217] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=90704) returned 1 [0049.217] CloseHandle (hObject=0x1a8) returned 1 [0049.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0049.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0049.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.218] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.218] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.218] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=90176) returned 1 [0049.218] CloseHandle (hObject=0x1a8) returned 1 [0049.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0049.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0049.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.219] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.219] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.219] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=89664) returned 1 [0049.219] CloseHandle (hObject=0x1a8) returned 1 [0049.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0049.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0049.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.220] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.220] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.220] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=90192) returned 1 [0049.220] CloseHandle (hObject=0x1a8) returned 1 [0049.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0049.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0049.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.221] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.221] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.221] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=87616) returned 1 [0049.222] CloseHandle (hObject=0x1a8) returned 1 [0049.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0049.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0049.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.222] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.222] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.223] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=87104) returned 1 [0049.223] CloseHandle (hObject=0x1a8) returned 1 [0049.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0049.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0049.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.223] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.224] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.224] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=70720) returned 1 [0049.224] CloseHandle (hObject=0x1a8) returned 1 [0049.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0049.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0049.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.224] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.225] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.225] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=70224) returned 1 [0049.225] CloseHandle (hObject=0x1a8) returned 1 [0049.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0049.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0049.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.225] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.226] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.226] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=70208) returned 1 [0049.226] CloseHandle (hObject=0x1a8) returned 1 [0049.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0049.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0049.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.226] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.227] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.227] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=383786) returned 1 [0049.227] CloseHandle (hObject=0x1a8) returned 1 [0049.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0049.227] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0049.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0049.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\bootmgr.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.228] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.228] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x27) returned 0 [0049.228] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.229] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=8192) returned 1 [0049.229] CloseHandle (hObject=0x1a8) returned 1 [0049.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0049.232] SetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0049.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x26 [0049.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\bootsect.bak.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.232] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.233] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f780 | out: lpNewFilePointer=0x0) returned 1 [0049.233] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f780 | out: lpNewFilePointer=0x0) returned 1 [0049.233] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\bootsect.bak.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x1ac [0049.235] ReadFile (in: hFile=0x1a8, lpBuffer=0x3180020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2c3f78c, lpOverlapped=0x0 | out: lpBuffer=0x3180020*, lpNumberOfBytesRead=0x2c3f78c*=0x2000, lpOverlapped=0x0) returned 1 [0049.442] WriteFile (in: hFile=0x1ac, lpBuffer=0x3180020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2c3f770, lpOverlapped=0x0 | out: lpBuffer=0x3180020*, lpNumberOfBytesWritten=0x2c3f770*=0x2010, lpOverlapped=0x0) returned 1 [0049.444] WriteFile (in: hFile=0x1ac, lpBuffer=0x3180020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c3f770, lpOverlapped=0x0 | out: lpBuffer=0x3180020*, lpNumberOfBytesWritten=0x2c3f770*=0xf2, lpOverlapped=0x0) returned 1 [0049.444] CloseHandle (hObject=0x1a8) returned 1 [0049.444] CloseHandle (hObject=0x1ac) returned 1 [0049.445] DeleteFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0049.622] SetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight", dwFileAttributes=0x27) returned 1 [0049.623] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0049.623] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=2506240) returned 1 [0049.623] CloseHandle (hObject=0x1a4) returned 1 [0049.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020 [0049.623] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 1 [0049.624] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0049.624] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f608 | out: lpNewFilePointer=0x0) returned 1 [0049.625] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f608 | out: lpNewFilePointer=0x0) returned 1 [0049.625] ReadFile (in: hFile=0x1a4, lpBuffer=0x3180058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c3f614, lpOverlapped=0x0 | out: lpBuffer=0x3180058*, lpNumberOfBytesRead=0x2c3f614*=0x40000, lpOverlapped=0x0) returned 1 [0049.826] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f608 | out: lpNewFilePointer=0x0) returned 1 [0049.826] ReadFile (in: hFile=0x1a4, lpBuffer=0x31c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c3f614, lpOverlapped=0x0 | out: lpBuffer=0x31c0058*, lpNumberOfBytesRead=0x2c3f614*=0x40000, lpOverlapped=0x0) returned 1 [0050.297] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f608 | out: lpNewFilePointer=0x0) returned 1 [0050.297] ReadFile (in: hFile=0x1a4, lpBuffer=0x3200058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c3f614, lpOverlapped=0x0 | out: lpBuffer=0x3200058*, lpNumberOfBytesRead=0x2c3f614*=0x40000, lpOverlapped=0x0) returned 1 [0050.321] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f778 | out: lpNewFilePointer=0x0) returned 1 [0050.321] WriteFile (in: hFile=0x1a4, lpBuffer=0x3180020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2c3f770, lpOverlapped=0x0 | out: lpBuffer=0x3180020*, lpNumberOfBytesWritten=0x2c3f770*=0xc0112, lpOverlapped=0x0) returned 1 [0052.395] SetEndOfFile (hFile=0x1a4) returned 1 [0052.395] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f610 | out: lpNewFilePointer=0x0) returned 1 [0052.396] WriteFile (in: hFile=0x1a4, lpBuffer=0x324014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x324014a*, lpNumberOfBytesWritten=0x2c3f61c*=0x40000, lpOverlapped=0x0) returned 1 [0052.399] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f610 | out: lpNewFilePointer=0x0) returned 1 [0052.399] WriteFile (in: hFile=0x1a4, lpBuffer=0x324014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x324014a*, lpNumberOfBytesWritten=0x2c3f61c*=0x40000, lpOverlapped=0x0) returned 1 [0052.405] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f610 | out: lpNewFilePointer=0x0) returned 1 [0052.405] WriteFile (in: hFile=0x1a4, lpBuffer=0x324014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x324014a*, lpNumberOfBytesWritten=0x2c3f61c*=0x40000, lpOverlapped=0x0) returned 1 [0052.407] CloseHandle (hObject=0x1a4) returned 1 [0053.050] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0053.050] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=1565) returned 1 [0053.050] CloseHandle (hObject=0x1a4) returned 1 [0053.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0053.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0053.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0053.051] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0053.051] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f780 | out: lpNewFilePointer=0x0) returned 1 [0053.051] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f780 | out: lpNewFilePointer=0x0) returned 1 [0053.051] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1bc [0053.052] ReadFile (in: hFile=0x1a4, lpBuffer=0x3180020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2c3f78c, lpOverlapped=0x0 | out: lpBuffer=0x3180020*, lpNumberOfBytesRead=0x2c3f78c*=0x61d, lpOverlapped=0x0) returned 1 [0053.268] WriteFile (in: hFile=0x1bc, lpBuffer=0x3180020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2c3f770, lpOverlapped=0x0 | out: lpBuffer=0x3180020*, lpNumberOfBytesWritten=0x2c3f770*=0x620, lpOverlapped=0x0) returned 1 [0053.270] WriteFile (in: hFile=0x1bc, lpBuffer=0x3180020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c3f770, lpOverlapped=0x0 | out: lpBuffer=0x3180020*, lpNumberOfBytesWritten=0x2c3f770*=0xf2, lpOverlapped=0x0) returned 1 [0053.270] CloseHandle (hObject=0x1a4) returned 1 [0053.271] CloseHandle (hObject=0x1bc) returned 1 [0053.274] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0053.276] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0053.276] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=2296) returned 1 [0053.276] CloseHandle (hObject=0x1bc) returned 1 [0053.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0053.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0053.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0053.277] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0053.277] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f780 | out: lpNewFilePointer=0x0) returned 1 [0053.277] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f780 | out: lpNewFilePointer=0x0) returned 1 [0053.277] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1a4 [0053.277] ReadFile (in: hFile=0x1bc, lpBuffer=0x3180020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2c3f78c, lpOverlapped=0x0 | out: lpBuffer=0x3180020*, lpNumberOfBytesRead=0x2c3f78c*=0x8f8, lpOverlapped=0x0) returned 1 [0053.302] WriteFile (in: hFile=0x1a4, lpBuffer=0x3180020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2c3f770, lpOverlapped=0x0 | out: lpBuffer=0x3180020*, lpNumberOfBytesWritten=0x2c3f770*=0x900, lpOverlapped=0x0) returned 1 [0053.304] WriteFile (in: hFile=0x1a4, lpBuffer=0x3180020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c3f770, lpOverlapped=0x0 | out: lpBuffer=0x3180020*, lpNumberOfBytesWritten=0x2c3f770*=0xf2, lpOverlapped=0x0) returned 1 [0053.304] CloseHandle (hObject=0x1bc) returned 1 [0053.304] CloseHandle (hObject=0x1a4) returned 1 [0053.305] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0053.306] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0053.307] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=2503680) returned 1 [0053.307] CloseHandle (hObject=0x1a4) returned 1 [0053.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi")) returned 0x2020 [0053.307] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 1 [0053.308] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0053.308] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f608 | out: lpNewFilePointer=0x0) returned 1 [0053.308] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f608 | out: lpNewFilePointer=0x0) returned 1 [0053.308] ReadFile (in: hFile=0x1a4, lpBuffer=0x3180058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c3f614, lpOverlapped=0x0 | out: lpBuffer=0x3180058*, lpNumberOfBytesRead=0x2c3f614*=0x40000, lpOverlapped=0x0) returned 1 [0053.472] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f608 | out: lpNewFilePointer=0x0) returned 1 [0053.473] ReadFile (in: hFile=0x1a4, lpBuffer=0x31c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c3f614, lpOverlapped=0x0 | out: lpBuffer=0x31c0058*, lpNumberOfBytesRead=0x2c3f614*=0x40000, lpOverlapped=0x0) returned 1 [0053.497] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f608 | out: lpNewFilePointer=0x0) returned 1 [0053.497] ReadFile (in: hFile=0x1a4, lpBuffer=0x3200058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c3f614, lpOverlapped=0x0 | out: lpBuffer=0x3200058*, lpNumberOfBytesRead=0x2c3f614*=0x40000, lpOverlapped=0x0) returned 1 [0053.516] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f778 | out: lpNewFilePointer=0x0) returned 1 [0053.766] WriteFile (in: hFile=0x1a4, lpBuffer=0x3180020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2c3f770, lpOverlapped=0x0 | out: lpBuffer=0x3180020*, lpNumberOfBytesWritten=0x2c3f770*=0xc0112, lpOverlapped=0x0) returned 1 [0053.794] SetEndOfFile (hFile=0x1a4) returned 1 [0053.794] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f610 | out: lpNewFilePointer=0x0) returned 1 [0053.794] WriteFile (in: hFile=0x1a4, lpBuffer=0x324014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x324014a*, lpNumberOfBytesWritten=0x2c3f61c*=0x40000, lpOverlapped=0x0) returned 1 [0053.802] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f610 | out: lpNewFilePointer=0x0) returned 1 [0053.802] WriteFile (in: hFile=0x1a4, lpBuffer=0x324014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x324014a*, lpNumberOfBytesWritten=0x2c3f61c*=0x40000, lpOverlapped=0x0) returned 1 [0053.808] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f610 | out: lpNewFilePointer=0x0) returned 1 [0053.808] WriteFile (in: hFile=0x1a4, lpBuffer=0x324014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x324014a*, lpNumberOfBytesWritten=0x2c3f61c*=0x40000, lpOverlapped=0x0) returned 1 [0053.810] CloseHandle (hObject=0x1a4) returned 1 [0055.212] SetEvent (hEvent=0x168) returned 1 [0055.213] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0055.214] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=1450) returned 1 [0055.214] CloseHandle (hObject=0x1b8) returned 1 [0055.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0055.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0055.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0055.214] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0055.214] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f780 | out: lpNewFilePointer=0x0) returned 1 [0055.215] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f780 | out: lpNewFilePointer=0x0) returned 1 [0055.215] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c4 [0055.215] ReadFile (in: hFile=0x1b8, lpBuffer=0x3180020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2c3f78c, lpOverlapped=0x0 | out: lpBuffer=0x3180020*, lpNumberOfBytesRead=0x2c3f78c*=0x5aa, lpOverlapped=0x0) returned 1 [0055.240] WriteFile (in: hFile=0x1c4, lpBuffer=0x3180020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c3f770, lpOverlapped=0x0 | out: lpBuffer=0x3180020*, lpNumberOfBytesWritten=0x2c3f770*=0x5b0, lpOverlapped=0x0) returned 1 [0055.241] WriteFile (in: hFile=0x1c4, lpBuffer=0x3180020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2c3f770, lpOverlapped=0x0 | out: lpBuffer=0x3180020*, lpNumberOfBytesWritten=0x2c3f770*=0x102, lpOverlapped=0x0) returned 1 [0055.241] CloseHandle (hObject=0x1b8) returned 1 [0055.241] CloseHandle (hObject=0x1c4) returned 1 [0055.242] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0055.243] SetEvent (hEvent=0x168) returned 1 [0055.244] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0055.257] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=70361744) returned 1 [0055.257] CloseHandle (hObject=0x1c4) returned 1 [0055.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020 [0055.261] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 1 [0055.262] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0055.262] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f608 | out: lpNewFilePointer=0x0) returned 1 [0055.262] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f608 | out: lpNewFilePointer=0x0) returned 1 [0055.262] ReadFile (in: hFile=0x1c4, lpBuffer=0x3180058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c3f614, lpOverlapped=0x0 | out: lpBuffer=0x3180058*, lpNumberOfBytesRead=0x2c3f614*=0x40000, lpOverlapped=0x0) returned 1 [0055.271] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f608 | out: lpNewFilePointer=0x0) returned 1 [0055.272] ReadFile (in: hFile=0x1c4, lpBuffer=0x31c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c3f614, lpOverlapped=0x0 | out: lpBuffer=0x31c0058*, lpNumberOfBytesRead=0x2c3f614*=0x40000, lpOverlapped=0x0) returned 1 [0057.945] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f608 | out: lpNewFilePointer=0x0) returned 1 [0057.945] ReadFile (in: hFile=0x1c4, lpBuffer=0x3200058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c3f614, lpOverlapped=0x0 | out: lpBuffer=0x3200058*, lpNumberOfBytesRead=0x2c3f614*=0x40000, lpOverlapped=0x0) returned 1 [0057.966] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f778 | out: lpNewFilePointer=0x0) returned 1 [0057.966] WriteFile (in: hFile=0x1c4, lpBuffer=0x3180020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2c3f770, lpOverlapped=0x0 | out: lpBuffer=0x3180020*, lpNumberOfBytesWritten=0x2c3f770*=0xc0102, lpOverlapped=0x0) returned 1 [0057.983] SetEndOfFile (hFile=0x1c4) returned 1 [0057.984] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f610 | out: lpNewFilePointer=0x0) returned 1 [0057.984] WriteFile (in: hFile=0x1c4, lpBuffer=0x324013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x324013a*, lpNumberOfBytesWritten=0x2c3f61c*=0x40000, lpOverlapped=0x0) returned 1 [0057.986] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f610 | out: lpNewFilePointer=0x0) returned 1 [0057.986] WriteFile (in: hFile=0x1c4, lpBuffer=0x324013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x324013a*, lpNumberOfBytesWritten=0x2c3f61c*=0x40000, lpOverlapped=0x0) returned 1 [0057.987] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f610 | out: lpNewFilePointer=0x0) returned 1 [0057.987] WriteFile (in: hFile=0x1c4, lpBuffer=0x324013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x324013a*, lpNumberOfBytesWritten=0x2c3f61c*=0x40000, lpOverlapped=0x0) returned 1 [0057.988] CloseHandle (hObject=0x1c4) returned 1 [0061.726] SetEvent (hEvent=0x168) returned 1 [0061.726] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0061.727] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=9958388) returned 1 [0061.727] CloseHandle (hObject=0x1c4) returned 1 [0061.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0061.727] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 1 [0061.728] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0061.728] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f608 | out: lpNewFilePointer=0x0) returned 1 [0061.728] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f608 | out: lpNewFilePointer=0x0) returned 1 [0061.728] ReadFile (in: hFile=0x1c4, lpBuffer=0x3180058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c3f614, lpOverlapped=0x0 | out: lpBuffer=0x3180058*, lpNumberOfBytesRead=0x2c3f614*=0x40000, lpOverlapped=0x0) returned 1 [0061.751] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f608 | out: lpNewFilePointer=0x0) returned 1 [0061.751] ReadFile (in: hFile=0x1c4, lpBuffer=0x31c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c3f614, lpOverlapped=0x0 | out: lpBuffer=0x31c0058*, lpNumberOfBytesRead=0x2c3f614*=0x40000, lpOverlapped=0x0) returned 1 [0062.551] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f608 | out: lpNewFilePointer=0x0) returned 1 [0062.551] ReadFile (in: hFile=0x1c4, lpBuffer=0x3200058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c3f614, lpOverlapped=0x0 | out: lpBuffer=0x3200058*, lpNumberOfBytesRead=0x2c3f614*=0x40000, lpOverlapped=0x0) returned 1 [0063.124] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f778 | out: lpNewFilePointer=0x0) returned 1 [0063.124] WriteFile (in: hFile=0x1c4, lpBuffer=0x3180020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2c3f770, lpOverlapped=0x0 | out: lpBuffer=0x3180020*, lpNumberOfBytesWritten=0x2c3f770*=0xc0102, lpOverlapped=0x0) returned 1 [0063.662] SetEndOfFile (hFile=0x1c4) returned 1 [0063.663] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f610 | out: lpNewFilePointer=0x0) returned 1 [0063.663] WriteFile (in: hFile=0x1c4, lpBuffer=0x324013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x324013a*, lpNumberOfBytesWritten=0x2c3f61c*=0x40000, lpOverlapped=0x0) returned 1 [0063.665] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f610 | out: lpNewFilePointer=0x0) returned 1 [0063.665] WriteFile (in: hFile=0x1c4, lpBuffer=0x324013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x324013a*, lpNumberOfBytesWritten=0x2c3f61c*=0x40000, lpOverlapped=0x0) returned 1 [0063.669] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f610 | out: lpNewFilePointer=0x0) returned 1 [0063.669] WriteFile (in: hFile=0x1c4, lpBuffer=0x324013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x324013a*, lpNumberOfBytesWritten=0x2c3f61c*=0x40000, lpOverlapped=0x0) returned 1 [0063.671] CloseHandle (hObject=0x1c4) returned 1 [0069.897] SetEvent (hEvent=0x168) returned 1 [0069.899] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.900] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=2865664) returned 1 [0069.900] CloseHandle (hObject=0x1cc) returned 1 [0069.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0069.900] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 1 [0069.901] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0069.901] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f608 | out: lpNewFilePointer=0x0) returned 1 [0069.901] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f608 | out: lpNewFilePointer=0x0) returned 1 [0069.901] ReadFile (in: hFile=0x1cc, lpBuffer=0x3180058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c3f614, lpOverlapped=0x0 | out: lpBuffer=0x3180058*, lpNumberOfBytesRead=0x2c3f614*=0x40000, lpOverlapped=0x0) returned 1 [0069.907] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f608 | out: lpNewFilePointer=0x0) returned 1 [0069.907] ReadFile (in: hFile=0x1cc, lpBuffer=0x31c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c3f614, lpOverlapped=0x0 | out: lpBuffer=0x31c0058*, lpNumberOfBytesRead=0x2c3f614*=0x40000, lpOverlapped=0x0) returned 1 [0069.923] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f608 | out: lpNewFilePointer=0x0) returned 1 [0069.923] ReadFile (in: hFile=0x1cc, lpBuffer=0x3200058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c3f614, lpOverlapped=0x0 | out: lpBuffer=0x3200058*, lpNumberOfBytesRead=0x2c3f614*=0x40000, lpOverlapped=0x0) returned 1 [0069.941] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f778 | out: lpNewFilePointer=0x0) returned 1 [0069.941] WriteFile (in: hFile=0x1cc, lpBuffer=0x3180020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2c3f770, lpOverlapped=0x0 | out: lpBuffer=0x3180020*, lpNumberOfBytesWritten=0x2c3f770*=0xc0112, lpOverlapped=0x0) returned 1 [0070.128] SetEndOfFile (hFile=0x1cc) returned 1 [0070.129] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f610 | out: lpNewFilePointer=0x0) returned 1 [0070.129] WriteFile (in: hFile=0x1cc, lpBuffer=0x324014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x324014a*, lpNumberOfBytesWritten=0x2c3f61c*=0x40000, lpOverlapped=0x0) returned 1 [0070.132] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f610 | out: lpNewFilePointer=0x0) returned 1 [0070.132] WriteFile (in: hFile=0x1cc, lpBuffer=0x324014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x324014a*, lpNumberOfBytesWritten=0x2c3f61c*=0x40000, lpOverlapped=0x0) returned 1 [0070.136] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f610 | out: lpNewFilePointer=0x0) returned 1 [0070.136] WriteFile (in: hFile=0x1cc, lpBuffer=0x324014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c3f61c, lpOverlapped=0x0 | out: lpBuffer=0x324014a*, lpNumberOfBytesWritten=0x2c3f61c*=0x40000, lpOverlapped=0x0) returned 1 [0070.138] CloseHandle (hObject=0x1cc) returned 1 [0070.617] SetEvent (hEvent=0x168) returned 1 [0070.618] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.618] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=3186) returned 1 [0070.618] CloseHandle (hObject=0x1cc) returned 1 [0070.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0070.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0070.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0070.618] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.618] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f780 | out: lpNewFilePointer=0x0) returned 1 [0070.618] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f780 | out: lpNewFilePointer=0x0) returned 1 [0070.619] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1b4 [0070.619] ReadFile (in: hFile=0x1cc, lpBuffer=0x3180020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2c3f78c, lpOverlapped=0x0 | out: lpBuffer=0x3180020*, lpNumberOfBytesRead=0x2c3f78c*=0xc72, lpOverlapped=0x0) returned 1 [0070.648] WriteFile (in: hFile=0x1b4, lpBuffer=0x3180020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2c3f770, lpOverlapped=0x0 | out: lpBuffer=0x3180020*, lpNumberOfBytesWritten=0x2c3f770*=0xc80, lpOverlapped=0x0) returned 1 [0070.649] WriteFile (in: hFile=0x1b4, lpBuffer=0x3180020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c3f770, lpOverlapped=0x0 | out: lpBuffer=0x3180020*, lpNumberOfBytesWritten=0x2c3f770*=0xf2, lpOverlapped=0x0) returned 1 [0070.649] CloseHandle (hObject=0x1cc) returned 1 [0070.649] CloseHandle (hObject=0x1b4) returned 1 [0070.653] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0070.654] SetEvent (hEvent=0x168) returned 1 [0070.655] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0070.655] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=4207) returned 1 [0070.655] CloseHandle (hObject=0x1b4) returned 1 [0070.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0070.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0070.655] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0070.655] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0070.655] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f780 | out: lpNewFilePointer=0x0) returned 1 [0070.655] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f780 | out: lpNewFilePointer=0x0) returned 1 [0070.655] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1cc [0070.656] ReadFile (in: hFile=0x1b4, lpBuffer=0x3180020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2c3f78c, lpOverlapped=0x0 | out: lpBuffer=0x3180020*, lpNumberOfBytesRead=0x2c3f78c*=0x106f, lpOverlapped=0x0) returned 1 [0070.665] WriteFile (in: hFile=0x1cc, lpBuffer=0x3180020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2c3f770, lpOverlapped=0x0 | out: lpBuffer=0x3180020*, lpNumberOfBytesWritten=0x2c3f770*=0x1070, lpOverlapped=0x0) returned 1 [0070.666] WriteFile (in: hFile=0x1cc, lpBuffer=0x3180020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c3f770, lpOverlapped=0x0 | out: lpBuffer=0x3180020*, lpNumberOfBytesWritten=0x2c3f770*=0xf2, lpOverlapped=0x0) returned 1 [0070.666] CloseHandle (hObject=0x1b4) returned 1 [0070.666] CloseHandle (hObject=0x1cc) returned 1 [0070.670] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0070.671] SetEvent (hEvent=0x168) returned 1 [0070.671] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.672] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2c3f7b8 | out: lpFileSize=0x2c3f7b8*=2424) returned 1 [0070.672] CloseHandle (hObject=0x1cc) returned 1 [0070.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0070.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0070.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0070.672] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.672] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f780 | out: lpNewFilePointer=0x0) returned 1 [0070.672] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3f780 | out: lpNewFilePointer=0x0) returned 1 [0070.672] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) Thread: id = 23 os_tid = 0x4fc [0048.909] GetProcessHeap () returned 0x350000 [0048.909] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x428618 [0048.910] GetProcessHeap () returned 0x350000 [0048.910] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x438620 [0048.910] GetProcessHeap () returned 0x350000 [0048.910] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x28) returned 0x3752d8 [0048.910] GetProcessHeap () returned 0x350000 [0048.910] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x110102) returned 0x32a0020 [0048.911] GetProcessHeap () returned 0x350000 [0048.911] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x50) returned 0x36f6d8 [0048.911] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0048.911] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0048.911] Wow64DisableWow64FsRedirection (in: OldValue=0x2fff8e4 | out: OldValue=0x2fff8e4*=0x0) returned 1 [0048.911] GetProcessHeap () returned 0x350000 [0048.911] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36f6d8 | out: hHeap=0x350000) returned 1 [0048.912] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0049.004] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2fff890 | out: lpFileSize=0x2fff890*=0) returned 1 [0049.004] CloseHandle (hObject=0x160) returned 1 [0049.004] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0049.004] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2fff890 | out: lpFileSize=0x2fff890*=65536) returned 1 [0049.004] CloseHandle (hObject=0x160) returned 1 [0049.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0049.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0049.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\bootstat.dat.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0049.005] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0049.005] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fff858 | out: lpNewFilePointer=0x0) returned 1 [0049.005] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fff858 | out: lpNewFilePointer=0x0) returned 1 [0049.005] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\boot\\bootstat.dat.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x164 [0049.005] ReadFile (in: hFile=0x160, lpBuffer=0x32a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fff864, lpOverlapped=0x0 | out: lpBuffer=0x32a0020*, lpNumberOfBytesRead=0x2fff864*=0x10000, lpOverlapped=0x0) returned 1 [0049.242] WriteFile (in: hFile=0x164, lpBuffer=0x32a0020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x2fff848, lpOverlapped=0x0 | out: lpBuffer=0x32a0020*, lpNumberOfBytesWritten=0x2fff848*=0x10010, lpOverlapped=0x0) returned 1 [0049.245] WriteFile (in: hFile=0x164, lpBuffer=0x32a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fff848, lpOverlapped=0x0 | out: lpBuffer=0x32a0020*, lpNumberOfBytesWritten=0x2fff848*=0xf2, lpOverlapped=0x0) returned 1 [0049.245] CloseHandle (hObject=0x160) returned 1 [0049.245] CloseHandle (hObject=0x164) returned 1 [0049.248] DeleteFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0049.250] CreateFileW (lpFileName="\\\\?\\C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.250] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0049.252] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2fff890 | out: lpFileSize=0x2fff890*=16972987) returned 1 [0049.252] CloseHandle (hObject=0x164) returned 1 [0049.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab")) returned 0x2020 [0049.252] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 1 [0049.254] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0049.255] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fff6e0 | out: lpNewFilePointer=0x0) returned 1 [0049.255] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fff6e0 | out: lpNewFilePointer=0x0) returned 1 [0049.255] ReadFile (in: hFile=0x164, lpBuffer=0x32a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fff6ec, lpOverlapped=0x0 | out: lpBuffer=0x32a0058*, lpNumberOfBytesRead=0x2fff6ec*=0x40000, lpOverlapped=0x0) returned 1 [0049.349] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x2fff6e0 | out: lpNewFilePointer=0x0) returned 1 [0049.349] ReadFile (in: hFile=0x164, lpBuffer=0x32e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fff6ec, lpOverlapped=0x0 | out: lpBuffer=0x32e0058*, lpNumberOfBytesRead=0x2fff6ec*=0x40000, lpOverlapped=0x0) returned 1 [0050.303] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x2fff6e0 | out: lpNewFilePointer=0x0) returned 1 [0050.303] ReadFile (in: hFile=0x164, lpBuffer=0x3320058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fff6ec, lpOverlapped=0x0 | out: lpBuffer=0x3320058*, lpNumberOfBytesRead=0x2fff6ec*=0x40000, lpOverlapped=0x0) returned 1 [0050.431] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fff850 | out: lpNewFilePointer=0x0) returned 1 [0050.431] WriteFile (in: hFile=0x164, lpBuffer=0x32a0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2fff848, lpOverlapped=0x0 | out: lpBuffer=0x32a0020*, lpNumberOfBytesWritten=0x2fff848*=0xc0102, lpOverlapped=0x0) returned 1 [0050.448] SetEndOfFile (hFile=0x164) returned 1 [0050.448] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x2fff6e8 | out: lpNewFilePointer=0x0) returned 1 [0050.448] WriteFile (in: hFile=0x164, lpBuffer=0x336013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fff6f4, lpOverlapped=0x0 | out: lpBuffer=0x336013a*, lpNumberOfBytesWritten=0x2fff6f4*=0x40000, lpOverlapped=0x0) returned 1 [0050.451] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x2fff6e8 | out: lpNewFilePointer=0x0) returned 1 [0050.451] WriteFile (in: hFile=0x164, lpBuffer=0x336013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fff6f4, lpOverlapped=0x0 | out: lpBuffer=0x336013a*, lpNumberOfBytesWritten=0x2fff6f4*=0x40000, lpOverlapped=0x0) returned 1 [0050.452] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fff6e8 | out: lpNewFilePointer=0x0) returned 1 [0050.452] WriteFile (in: hFile=0x164, lpBuffer=0x336013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fff6f4, lpOverlapped=0x0 | out: lpBuffer=0x336013a*, lpNumberOfBytesWritten=0x2fff6f4*=0x40000, lpOverlapped=0x0) returned 1 [0050.453] CloseHandle (hObject=0x164) returned 1 [0058.872] SetEvent (hEvent=0x168) returned 1 [0058.888] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0058.895] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2fff890 | out: lpFileSize=0x2fff890*=1886) returned 1 [0058.895] CloseHandle (hObject=0x164) returned 1 [0058.895] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0058.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0058.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0058.918] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0058.918] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fff858 | out: lpNewFilePointer=0x0) returned 1 [0058.918] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fff858 | out: lpNewFilePointer=0x0) returned 1 [0058.918] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c8 [0058.918] ReadFile (in: hFile=0x164, lpBuffer=0x32a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fff864, lpOverlapped=0x0 | out: lpBuffer=0x32a0020*, lpNumberOfBytesRead=0x2fff864*=0x75e, lpOverlapped=0x0) returned 1 [0059.209] WriteFile (in: hFile=0x1c8, lpBuffer=0x32a0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2fff848, lpOverlapped=0x0 | out: lpBuffer=0x32a0020*, lpNumberOfBytesWritten=0x2fff848*=0x760, lpOverlapped=0x0) returned 1 [0059.256] WriteFile (in: hFile=0x1c8, lpBuffer=0x32a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fff848, lpOverlapped=0x0 | out: lpBuffer=0x32a0020*, lpNumberOfBytesWritten=0x2fff848*=0xf2, lpOverlapped=0x0) returned 1 [0059.284] CloseHandle (hObject=0x164) returned 1 [0059.284] CloseHandle (hObject=0x1c8) returned 1 [0059.563] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0059.612] SetEvent (hEvent=0x168) returned 1 [0059.612] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0059.617] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2fff890 | out: lpFileSize=0x2fff890*=2513920) returned 1 [0059.617] CloseHandle (hObject=0x1c8) returned 1 [0059.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0059.617] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 1 [0059.618] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0059.618] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fff6e0 | out: lpNewFilePointer=0x0) returned 1 [0059.618] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fff6e0 | out: lpNewFilePointer=0x0) returned 1 [0059.618] ReadFile (in: hFile=0x1c8, lpBuffer=0x32a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fff6ec, lpOverlapped=0x0 | out: lpBuffer=0x32a0058*, lpNumberOfBytesRead=0x2fff6ec*=0x40000, lpOverlapped=0x0) returned 1 [0059.625] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x2fff6e0 | out: lpNewFilePointer=0x0) returned 1 [0059.625] ReadFile (in: hFile=0x1c8, lpBuffer=0x32e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fff6ec, lpOverlapped=0x0 | out: lpBuffer=0x32e0058*, lpNumberOfBytesRead=0x2fff6ec*=0x40000, lpOverlapped=0x0) returned 1 [0059.645] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x2fff6e0 | out: lpNewFilePointer=0x0) returned 1 [0059.645] ReadFile (in: hFile=0x1c8, lpBuffer=0x3320058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fff6ec, lpOverlapped=0x0 | out: lpBuffer=0x3320058*, lpNumberOfBytesRead=0x2fff6ec*=0x40000, lpOverlapped=0x0) returned 1 [0060.243] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fff850 | out: lpNewFilePointer=0x0) returned 1 [0060.243] WriteFile (in: hFile=0x1c8, lpBuffer=0x32a0020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2fff848, lpOverlapped=0x0 | out: lpBuffer=0x32a0020*, lpNumberOfBytesWritten=0x2fff848*=0xc0112, lpOverlapped=0x0) returned 1 [0060.281] SetEndOfFile (hFile=0x1c8) returned 1 [0060.281] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x2fff6e8 | out: lpNewFilePointer=0x0) returned 1 [0060.281] WriteFile (in: hFile=0x1c8, lpBuffer=0x336014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fff6f4, lpOverlapped=0x0 | out: lpBuffer=0x336014a*, lpNumberOfBytesWritten=0x2fff6f4*=0x40000, lpOverlapped=0x0) returned 1 [0060.284] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x2fff6e8 | out: lpNewFilePointer=0x0) returned 1 [0060.284] WriteFile (in: hFile=0x1c8, lpBuffer=0x336014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fff6f4, lpOverlapped=0x0 | out: lpBuffer=0x336014a*, lpNumberOfBytesWritten=0x2fff6f4*=0x40000, lpOverlapped=0x0) returned 1 [0060.290] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fff6e8 | out: lpNewFilePointer=0x0) returned 1 [0060.290] WriteFile (in: hFile=0x1c8, lpBuffer=0x336014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fff6f4, lpOverlapped=0x0 | out: lpBuffer=0x336014a*, lpNumberOfBytesWritten=0x2fff6f4*=0x40000, lpOverlapped=0x0) returned 1 [0060.292] CloseHandle (hObject=0x1c8) returned 1 [0061.164] SetEvent (hEvent=0x168) returned 1 [0061.165] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0061.250] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2fff890 | out: lpFileSize=0x2fff890*=1450) returned 1 [0061.250] CloseHandle (hObject=0x1c8) returned 1 [0061.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0061.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0061.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0061.251] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0061.251] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fff858 | out: lpNewFilePointer=0x0) returned 1 [0061.251] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fff858 | out: lpNewFilePointer=0x0) returned 1 [0061.251] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x164 [0061.252] ReadFile (in: hFile=0x1c8, lpBuffer=0x32a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fff864, lpOverlapped=0x0 | out: lpBuffer=0x32a0020*, lpNumberOfBytesRead=0x2fff864*=0x5aa, lpOverlapped=0x0) returned 1 [0062.555] WriteFile (in: hFile=0x164, lpBuffer=0x32a0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2fff848, lpOverlapped=0x0 | out: lpBuffer=0x32a0020*, lpNumberOfBytesWritten=0x2fff848*=0x5b0, lpOverlapped=0x0) returned 1 [0062.556] WriteFile (in: hFile=0x164, lpBuffer=0x32a0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2fff848, lpOverlapped=0x0 | out: lpBuffer=0x32a0020*, lpNumberOfBytesWritten=0x2fff848*=0x102, lpOverlapped=0x0) returned 1 [0062.556] CloseHandle (hObject=0x1c8) returned 1 [0062.556] CloseHandle (hObject=0x164) returned 1 [0062.557] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0062.558] SetEvent (hEvent=0x168) returned 1 [0062.558] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0062.558] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2fff890 | out: lpFileSize=0x2fff890*=1608) returned 1 [0062.559] CloseHandle (hObject=0x164) returned 1 [0062.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0062.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0062.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 0xffffffff [0062.559] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0062.559] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fff858 | out: lpNewFilePointer=0x0) returned 1 [0062.559] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fff858 | out: lpNewFilePointer=0x0) returned 1 [0062.559] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c8 [0062.559] ReadFile (in: hFile=0x164, lpBuffer=0x32a0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fff864, lpOverlapped=0x0 | out: lpBuffer=0x32a0020*, lpNumberOfBytesRead=0x2fff864*=0x648, lpOverlapped=0x0) returned 1 [0063.271] WriteFile (in: hFile=0x1c8, lpBuffer=0x32a0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2fff848, lpOverlapped=0x0 | out: lpBuffer=0x32a0020*, lpNumberOfBytesWritten=0x2fff848*=0x650, lpOverlapped=0x0) returned 1 [0063.495] WriteFile (in: hFile=0x1c8, lpBuffer=0x32a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fff848, lpOverlapped=0x0 | out: lpBuffer=0x32a0020*, lpNumberOfBytesWritten=0x2fff848*=0xf2, lpOverlapped=0x0) returned 1 [0063.495] CloseHandle (hObject=0x164) returned 1 [0063.495] CloseHandle (hObject=0x1c8) returned 1 [0063.496] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0063.497] SetEvent (hEvent=0x168) returned 1 [0063.497] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0063.498] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2fff890 | out: lpFileSize=0x2fff890*=14819276) returned 1 [0063.498] CloseHandle (hObject=0x1c8) returned 1 [0063.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0063.498] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight")) returned 1 [0063.499] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id[9C354B42-2803].[mccreight.ellery@tutanota.com].eight" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id[9c354b42-2803].[mccreight.ellery@tutanota.com].eight"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0063.499] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fff6e0 | out: lpNewFilePointer=0x0) returned 1 [0063.499] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fff6e0 | out: lpNewFilePointer=0x0) returned 1 [0063.499] ReadFile (in: hFile=0x1c8, lpBuffer=0x32a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fff6ec, lpOverlapped=0x0 | out: lpBuffer=0x32a0058*, lpNumberOfBytesRead=0x2fff6ec*=0x40000, lpOverlapped=0x0) returned 1 [0063.739] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x2fff6e0 | out: lpNewFilePointer=0x0) returned 1 [0063.739] ReadFile (in: hFile=0x1c8, lpBuffer=0x32e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fff6ec, lpOverlapped=0x0 | out: lpBuffer=0x32e0058*, lpNumberOfBytesRead=0x2fff6ec*=0x40000, lpOverlapped=0x0) returned 1 [0065.667] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x2fff6e0 | out: lpNewFilePointer=0x0) returned 1 [0065.667] ReadFile (in: hFile=0x1c8, lpBuffer=0x3320058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fff6ec, lpOverlapped=0x0 | out: lpBuffer=0x3320058*, lpNumberOfBytesRead=0x2fff6ec*=0x40000, lpOverlapped=0x0) returned 1 [0065.681] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fff850 | out: lpNewFilePointer=0x0) returned 1 [0065.682] WriteFile (in: hFile=0x1c8, lpBuffer=0x32a0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2fff848, lpOverlapped=0x0 | out: lpBuffer=0x32a0020*, lpNumberOfBytesWritten=0x2fff848*=0xc0102, lpOverlapped=0x0) returned 1 [0066.158] SetEndOfFile (hFile=0x1c8) returned 1 [0066.158] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x2fff6e8 | out: lpNewFilePointer=0x0) returned 1 [0066.158] WriteFile (in: hFile=0x1c8, lpBuffer=0x336013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fff6f4, lpOverlapped=0x0 | out: lpBuffer=0x336013a*, lpNumberOfBytesWritten=0x2fff6f4*=0x40000, lpOverlapped=0x0) returned 1 [0066.160] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x2fff6e8 | out: lpNewFilePointer=0x0) returned 1 [0066.160] WriteFile (in: hFile=0x1c8, lpBuffer=0x336013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fff6f4, lpOverlapped=0x0 | out: lpBuffer=0x336013a*, lpNumberOfBytesWritten=0x2fff6f4*=0x40000, lpOverlapped=0x0) returned 1 [0066.161] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fff6e8 | out: lpNewFilePointer=0x0) returned 1 [0066.161] WriteFile (in: hFile=0x1c8, lpBuffer=0x336013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fff6f4, lpOverlapped=0x0 | out: lpBuffer=0x336013a*, lpNumberOfBytesWritten=0x2fff6f4*=0x40000, lpOverlapped=0x0) returned 1 [0066.162] CloseHandle (hObject=0x1c8) returned 1 [0070.728] SetEvent (hEvent=0x168) returned 1 [0070.729] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 24 os_tid = 0x31c [0048.915] GetProcessHeap () returned 0x350000 [0048.915] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x33c0048 [0048.916] GetProcessHeap () returned 0x350000 [0048.916] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x33d0050 [0048.916] GetProcessHeap () returned 0x350000 [0048.916] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x28) returned 0x375308 [0048.916] GetProcessHeap () returned 0x350000 [0048.916] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x110102) returned 0x34c0020 [0048.917] GetProcessHeap () returned 0x350000 [0048.917] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x50) returned 0x36f6d8 [0048.917] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0048.917] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0048.918] Wow64DisableWow64FsRedirection (in: OldValue=0x2edf9c4 | out: OldValue=0x2edf9c4*=0x0) returned 1 [0048.918] GetProcessHeap () returned 0x350000 [0048.918] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36f6d8 | out: hHeap=0x350000) returned 1 [0048.918] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.918] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.918] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.918] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.918] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.918] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.918] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.919] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.919] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.919] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.919] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.919] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.919] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.919] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.919] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.920] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.920] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.920] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.920] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.920] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.920] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.920] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.920] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.921] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.921] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.921] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.921] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.921] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.921] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.921] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.922] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.922] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.922] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.922] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.922] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.922] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.922] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.923] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.923] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.923] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.923] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.923] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.923] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.924] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.924] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.924] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.924] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.924] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.924] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.925] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.925] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.925] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.925] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.925] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.926] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.926] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.926] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.926] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.926] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.926] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.926] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.926] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.927] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.927] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.927] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.927] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.927] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.927] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.927] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.928] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.928] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.928] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.928] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.928] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.928] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.929] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.929] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.929] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.929] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.929] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.929] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.929] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.929] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.930] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.930] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.930] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.930] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.930] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.930] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.931] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.931] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.931] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.931] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.931] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.931] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.931] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.931] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.932] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.932] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.932] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.932] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.932] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.932] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.933] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.933] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.933] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.933] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.933] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.933] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.933] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.934] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.934] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.934] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.934] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.934] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.935] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.935] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.935] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.935] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.935] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.936] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.936] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.936] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.936] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.936] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.937] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.937] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.937] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.937] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.937] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.937] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.938] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.938] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.938] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.938] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.938] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.939] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.939] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.939] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.939] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.939] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.939] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.940] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.940] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.940] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.940] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.940] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.940] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.941] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.941] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.941] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.941] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.941] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.941] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.941] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.942] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.942] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.942] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.942] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.942] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.942] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.942] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.942] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.942] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.943] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.943] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.943] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.943] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.943] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.943] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.943] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.944] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.944] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.944] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.944] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.944] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.944] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.944] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.945] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.945] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.945] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.037] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.037] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.037] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.037] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.037] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.037] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.038] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.038] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.038] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.038] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.038] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.038] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.038] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.039] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.039] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.039] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.040] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.040] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.040] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.040] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.040] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.041] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.041] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.041] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.041] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.042] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.042] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.042] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.042] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.042] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.043] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.043] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.043] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.043] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.043] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.044] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.044] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.044] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.044] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.044] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.045] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.045] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.045] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.045] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.045] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.046] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.046] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.046] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.046] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.046] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.046] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.047] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.047] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.047] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.047] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.047] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.048] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.048] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.048] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.048] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.048] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.048] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.048] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.048] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.049] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.049] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.049] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.049] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 25 os_tid = 0x15c [0048.946] GetProcessHeap () returned 0x350000 [0048.946] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x33e0058 [0048.946] GetProcessHeap () returned 0x350000 [0048.946] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x10000) returned 0x33f0060 [0048.947] GetProcessHeap () returned 0x350000 [0048.947] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x28) returned 0x375338 [0048.947] GetProcessHeap () returned 0x350000 [0048.947] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x110102) returned 0x35e0020 [0048.948] GetProcessHeap () returned 0x350000 [0048.948] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x50) returned 0x36f6d8 [0048.948] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0048.948] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0048.948] Wow64DisableWow64FsRedirection (in: OldValue=0x317f8a4 | out: OldValue=0x317f8a4*=0x0) returned 1 [0048.948] GetProcessHeap () returned 0x350000 [0048.948] HeapFree (in: hHeap=0x350000, dwFlags=0x0, lpMem=0x36f6d8 | out: hHeap=0x350000) returned 1 [0048.948] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.948] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.949] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.949] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.949] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.949] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.949] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.949] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.949] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.949] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.949] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.950] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.950] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.950] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.950] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.950] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.950] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.950] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.950] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.950] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.950] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.951] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.951] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.951] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.951] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.951] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.951] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.951] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.951] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.952] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.952] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.952] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.952] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.952] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.952] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.952] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.952] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.952] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.953] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.953] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.953] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.953] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.953] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.953] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.953] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.953] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.953] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.954] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.954] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.954] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.954] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.954] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.954] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.954] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.954] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.954] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.954] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.955] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.955] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.955] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.955] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.955] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.955] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.955] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.955] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.956] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.956] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.956] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.956] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.956] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.956] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.956] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.956] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.956] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.957] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.957] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.957] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.957] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.957] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.957] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.957] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.958] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.958] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.958] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.958] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.958] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.958] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.958] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.958] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.958] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.958] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.959] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.959] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.959] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.959] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.959] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.959] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.959] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.960] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.960] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.960] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.960] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.960] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.960] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.961] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.961] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.961] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.962] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.962] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.962] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.962] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.962] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.962] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.962] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.963] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.963] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.963] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.963] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.963] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.963] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.963] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.964] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.964] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.964] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.964] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.964] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.965] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.965] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.965] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.965] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.965] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.965] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.965] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.965] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.966] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.966] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.966] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.966] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.966] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.966] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.966] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.967] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.967] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.967] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.967] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.967] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.967] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.967] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.967] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.968] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.968] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.968] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.968] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.968] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.968] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.968] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.969] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.969] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.969] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.969] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.969] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.969] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.969] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.969] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.970] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.970] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.970] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.970] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.970] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.970] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.970] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.970] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.971] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.971] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.971] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.971] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.971] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.971] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.971] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.971] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.971] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.971] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.972] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.972] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.972] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.972] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.972] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.972] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.972] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.972] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.973] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.973] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.973] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.973] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.973] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.973] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.973] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.973] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.974] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.974] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.974] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.974] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.974] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.974] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.974] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.975] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.975] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.975] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.975] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.975] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.975] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.975] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.975] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.975] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.975] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.976] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.976] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.976] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.976] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.976] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.976] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.976] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.977] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0048.977] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.071] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.071] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.071] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.071] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.071] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.071] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.071] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.072] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.072] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.072] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.072] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.072] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.072] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.073] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.073] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.073] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.073] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.073] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.073] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.073] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.074] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.074] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.074] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.074] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0049.074] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.019] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.019] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.019] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.019] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.019] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.019] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.019] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.019] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.019] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.019] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.019] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.019] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.019] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.020] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.020] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.020] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.020] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.020] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.020] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.020] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.020] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.020] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.020] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.020] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.020] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.020] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.020] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.020] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.021] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.021] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.021] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.021] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.021] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.021] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.021] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.021] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.021] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.021] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.021] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.021] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.021] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.021] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.022] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.022] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.022] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.022] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.022] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.022] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.022] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.022] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.022] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.022] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.022] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.022] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.022] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.022] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.022] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.023] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.023] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.023] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.023] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.023] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.023] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.023] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.023] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.023] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.023] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.023] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.023] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.023] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.023] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.024] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.024] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.024] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.024] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.024] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.024] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.024] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.024] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.024] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.024] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.024] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.025] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.025] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.025] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.025] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.025] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.025] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.025] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.025] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.025] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.025] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.025] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.025] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.026] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.026] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.026] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.026] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.026] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.026] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.026] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.026] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.026] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.026] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.026] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.026] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.026] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.026] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.027] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.027] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.027] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.027] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.027] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.027] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.027] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.027] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.027] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.027] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.027] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.027] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.027] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.027] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.028] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.028] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.028] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.028] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.028] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.028] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.028] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.028] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.028] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.028] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.028] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.028] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.028] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.028] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.028] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.029] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.029] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.029] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.029] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.029] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.029] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.029] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.029] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.029] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.029] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.029] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.029] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.029] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.029] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.029] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.030] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.030] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.030] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.030] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.030] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.030] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.030] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.030] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.030] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.030] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.030] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.030] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.030] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.030] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.031] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.031] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.031] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.031] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.031] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.031] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.031] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.031] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.031] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.031] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.031] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.031] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.031] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.031] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.032] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.032] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.032] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.032] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.032] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.032] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.032] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.032] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.032] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.032] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.032] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.032] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.032] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.032] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.033] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.033] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.033] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.033] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.033] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.033] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.033] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.033] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.033] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.033] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.033] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.033] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.033] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.033] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.033] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.034] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.034] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.034] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.034] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.034] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.034] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.034] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.034] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.034] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.034] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.034] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.034] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.034] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.034] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.034] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.035] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.035] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.035] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.035] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.035] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.035] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.035] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.035] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.035] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.035] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.035] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.035] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.035] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.035] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.036] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.036] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.036] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.036] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.036] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.036] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.036] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.036] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.036] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.036] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0058.036] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 Process: id = "2" image_name = "cusersnextadminappdatalocalfast.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersnextadminappdatalocalfast.exe" page_root = "0x4c97f000" os_pid = "0x5e0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x3a4" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cusersnextadminappdatalocalfast.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0x360 [0038.352] GetProcessHeap () returned 0x340000 [0038.352] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x30) returned 0x351818 [0038.352] GetProcessHeap () returned 0x340000 [0038.352] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x3a20) returned 0x3561e8 [0038.356] GetProcessHeap () returned 0x340000 [0038.356] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x300) returned 0x359c10 [0038.357] GetProcessHeap () returned 0x340000 [0038.357] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x351640 [0038.357] GetTickCount () returned 0x114497f [0038.357] GetProcessHeap () returned 0x340000 [0038.357] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x353b00 [0038.357] GetProcessHeap () returned 0x340000 [0038.357] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20a) returned 0x359f18 [0038.357] GetProcessHeap () returned 0x340000 [0038.357] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20a) returned 0x35a130 [0038.357] GetProcessHeap () returned 0x340000 [0038.357] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20a) returned 0x35a348 [0038.357] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x35a348, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cusersnextadminappdatalocalfast.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersnextadminappdatalocalfast.exe")) returned 0x49 [0038.357] GetProcessHeap () returned 0x340000 [0038.357] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a348 | out: hHeap=0x340000) returned 1 [0038.357] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tlup.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tlup.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0038.357] GetProcessHeap () returned 0x340000 [0038.357] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x359f18 | out: hHeap=0x340000) returned 1 [0038.357] GetProcessHeap () returned 0x340000 [0038.358] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a130 | out: hHeap=0x340000) returned 1 [0038.358] GetProcessHeap () returned 0x340000 [0038.358] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x353b00 | out: hHeap=0x340000) returned 1 [0038.358] GetVersion () returned 0x1db10106 [0038.358] GetCurrentProcess () returned 0xffffffff [0038.358] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x30f9b4 | out: TokenHandle=0x30f9b4*=0xa0) returned 1 [0038.358] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x14, TokenInformation=0x30f9ac, TokenInformationLength=0x4, ReturnLength=0x30f9b0 | out: TokenInformation=0x30f9ac, ReturnLength=0x30f9b0) returned 1 [0038.358] CloseHandle (hObject=0xa0) returned 1 [0038.358] GetProcessHeap () returned 0x340000 [0038.358] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x353b00 [0038.358] GetProcessHeap () returned 0x340000 [0038.358] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20a) returned 0x359f18 [0038.358] GetProcessHeap () returned 0x340000 [0038.358] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20a) returned 0x35a130 [0038.358] GetProcessHeap () returned 0x340000 [0038.358] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x359f18 | out: hHeap=0x340000) returned 1 [0038.358] GetProcessHeap () returned 0x340000 [0038.358] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a130 | out: hHeap=0x340000) returned 1 [0038.358] GetProcessHeap () returned 0x340000 [0038.358] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x353b50 [0038.358] GetProcessHeap () returned 0x340000 [0038.358] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x353b78 [0038.358] GetProcessHeap () returned 0x340000 [0038.358] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1e) returned 0x353ba0 [0038.358] GetProcessHeap () returned 0x340000 [0038.358] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x359f18 [0038.358] GetProcessHeap () returned 0x340000 [0038.358] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x359f18 | out: hHeap=0x340000) returned 1 [0038.358] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x353b78, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0038.358] GetProcessHeap () returned 0x340000 [0038.358] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x353ba0 | out: hHeap=0x340000) returned 1 [0038.359] GetProcessHeap () returned 0x340000 [0038.359] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x353b50 | out: hHeap=0x340000) returned 1 [0038.359] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x30f96c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x30f96c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0038.359] GetProcessHeap () returned 0x340000 [0038.359] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x353b78 | out: hHeap=0x340000) returned 1 [0038.359] GetProcessHeap () returned 0x340000 [0038.359] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x30) returned 0x359f18 [0038.359] GetProcessHeap () returned 0x340000 [0038.359] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x26) returned 0x359f50 [0038.359] GetProcessHeap () returned 0x340000 [0038.359] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x359f50, Size=0x4a) returned 0x359f50 [0038.359] GetProcessHeap () returned 0x340000 [0038.359] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x359f18 | out: hHeap=0x340000) returned 1 [0038.359] GetProcessHeap () returned 0x340000 [0038.359] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x359f50 | out: hHeap=0x340000) returned 1 [0038.359] GetProcessHeap () returned 0x340000 [0038.359] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1c) returned 0x353b78 [0038.360] GetProcessHeap () returned 0x340000 [0038.360] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1c) returned 0x353ba0 [0038.360] GetProcessHeap () returned 0x340000 [0038.360] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x359f30 [0038.360] GetProcessHeap () returned 0x340000 [0038.360] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x359f58 [0038.360] GetProcessHeap () returned 0x340000 [0038.360] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1e) returned 0x359f80 [0038.360] GetProcessHeap () returned 0x340000 [0038.360] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x35a718 [0038.360] GetProcessHeap () returned 0x340000 [0038.360] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a718 | out: hHeap=0x340000) returned 1 [0038.360] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x359f58, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0038.360] GetProcessHeap () returned 0x340000 [0038.360] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x359f80 | out: hHeap=0x340000) returned 1 [0038.360] GetProcessHeap () returned 0x340000 [0038.360] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x359f30 | out: hHeap=0x340000) returned 1 [0038.360] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x30f954, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x30f954*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0038.360] GetProcessHeap () returned 0x340000 [0038.360] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x359f58 | out: hHeap=0x340000) returned 1 [0038.360] GetProcessHeap () returned 0x340000 [0038.360] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x353ed8 [0038.360] GetProcessHeap () returned 0x340000 [0038.360] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3a) returned 0x353f20 [0038.360] GetProcessHeap () returned 0x340000 [0038.360] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x353f20, Size=0x72) returned 0x34f868 [0038.360] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0038.361] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0xa0 [0038.361] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0x0) returned 0x0 [0038.361] GetProcessHeap () returned 0x340000 [0038.361] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x353ed8 | out: hHeap=0x340000) returned 1 [0038.361] GetProcessHeap () returned 0x340000 [0038.361] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x34f868 | out: hHeap=0x340000) returned 1 [0038.361] GetProcessHeap () returned 0x340000 [0038.361] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x359f30 [0038.361] GetProcessHeap () returned 0x340000 [0038.361] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x359f58 [0038.361] GetProcessHeap () returned 0x340000 [0038.361] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1e) returned 0x359f80 [0038.361] GetProcessHeap () returned 0x340000 [0038.361] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x35a718 [0038.361] GetProcessHeap () returned 0x340000 [0038.361] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a718 | out: hHeap=0x340000) returned 1 [0038.361] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x359f58, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0038.361] GetProcessHeap () returned 0x340000 [0038.361] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x359f80 | out: hHeap=0x340000) returned 1 [0038.361] GetProcessHeap () returned 0x340000 [0038.361] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x359f30 | out: hHeap=0x340000) returned 1 [0038.361] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x30f93c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x30f93c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0038.361] GetProcessHeap () returned 0x340000 [0038.361] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x359f58 | out: hHeap=0x340000) returned 1 [0038.361] GetProcessHeap () returned 0x340000 [0038.361] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x353ed8 [0038.361] GetProcessHeap () returned 0x340000 [0038.361] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3a) returned 0x353f20 [0038.361] GetProcessHeap () returned 0x340000 [0038.362] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x353f20, Size=0x72) returned 0x34f868 [0038.362] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0xa4 [0038.362] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x0) returned 0x102 [0038.362] CloseHandle (hObject=0xa4) returned 1 [0038.362] GetProcessHeap () returned 0x340000 [0038.362] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x353ed8 | out: hHeap=0x340000) returned 1 [0038.362] GetProcessHeap () returned 0x340000 [0038.362] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x34f868 | out: hHeap=0x340000) returned 1 [0038.362] GetProcessHeap () returned 0x340000 [0038.362] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x359f30 [0038.362] GetProcessHeap () returned 0x340000 [0038.362] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x359f58 [0038.362] GetProcessHeap () returned 0x340000 [0038.362] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1e) returned 0x359f80 [0038.362] GetProcessHeap () returned 0x340000 [0038.362] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x35a718 [0038.362] GetProcessHeap () returned 0x340000 [0038.362] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a718 | out: hHeap=0x340000) returned 1 [0038.362] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x359f58, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0038.362] GetProcessHeap () returned 0x340000 [0038.362] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x359f80 | out: hHeap=0x340000) returned 1 [0038.362] GetProcessHeap () returned 0x340000 [0038.362] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x359f30 | out: hHeap=0x340000) returned 1 [0038.362] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x30f974, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x30f974*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0038.362] GetProcessHeap () returned 0x340000 [0038.363] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x359f58 | out: hHeap=0x340000) returned 1 [0038.363] GetProcessHeap () returned 0x340000 [0038.363] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x60) returned 0x35a718 [0038.363] GetProcessHeap () returned 0x340000 [0038.363] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x359f30 [0038.363] GetProcessHeap () returned 0x340000 [0038.363] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x359f58 [0038.363] GetProcessHeap () returned 0x340000 [0038.363] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1e) returned 0x359f80 [0038.363] GetProcessHeap () returned 0x340000 [0038.363] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x35a780 [0038.363] GetProcessHeap () returned 0x340000 [0038.363] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a780 | out: hHeap=0x340000) returned 1 [0038.363] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x359f58, nSize=0xf | out: lpDst="") returned 0x2c [0038.363] GetProcessHeap () returned 0x340000 [0038.363] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x359f80 | out: hHeap=0x340000) returned 1 [0038.363] GetProcessHeap () returned 0x340000 [0038.363] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x359f58, Size=0x3a) returned 0x353ed8 [0038.363] GetProcessHeap () returned 0x340000 [0038.363] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x3a) returned 0x353f20 [0038.363] GetProcessHeap () returned 0x340000 [0038.363] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x35a780 [0038.363] GetProcessHeap () returned 0x340000 [0038.363] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a780 | out: hHeap=0x340000) returned 1 [0038.363] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x353ed8, nSize=0x1d | out: lpDst="") returned 0x2c [0038.363] GetProcessHeap () returned 0x340000 [0038.364] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x353f20 | out: hHeap=0x340000) returned 1 [0038.364] GetProcessHeap () returned 0x340000 [0038.364] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x353ed8, Size=0x72) returned 0x34f868 [0038.364] GetProcessHeap () returned 0x340000 [0038.364] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x72) returned 0x34f8e8 [0038.364] GetProcessHeap () returned 0x340000 [0038.364] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x35a780 [0038.364] GetProcessHeap () returned 0x340000 [0038.364] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a780 | out: hHeap=0x340000) returned 1 [0038.364] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x34f868, nSize=0x39 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x2c [0038.364] GetProcessHeap () returned 0x340000 [0038.364] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x34f8e8 | out: hHeap=0x340000) returned 1 [0038.364] GetProcessHeap () returned 0x340000 [0038.364] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x359f30 | out: hHeap=0x340000) returned 1 [0038.364] GetProcessHeap () returned 0x340000 [0038.364] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x353ed8 [0038.364] GetProcessHeap () returned 0x340000 [0038.364] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3e) returned 0x353f20 [0038.364] GetProcessHeap () returned 0x340000 [0038.364] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x3e) returned 0x353f68 [0038.364] GetProcessHeap () returned 0x340000 [0038.364] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x35a780 [0038.364] GetProcessHeap () returned 0x340000 [0038.364] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x10) returned 0x351658 [0038.364] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x30f894 | out: phkResult=0x30f894*=0xa8) returned 0x0 [0038.364] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x30f890, lpData=0x353f68, lpcbData=0x30f898*=0x3e | out: lpType=0x30f890*=0x2, lpData=0x353f68*=0x2f, lpcbData=0x30f898*=0x98) returned 0xea [0038.364] RegCloseKey (hKey=0xa8) returned 0x0 [0038.364] GetProcessHeap () returned 0x340000 [0038.365] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x351658 | out: hHeap=0x340000) returned 1 [0038.365] GetProcessHeap () returned 0x340000 [0038.365] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a780 | out: hHeap=0x340000) returned 1 [0038.365] GetProcessHeap () returned 0x340000 [0038.365] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x353f68 | out: hHeap=0x340000) returned 1 [0038.365] GetProcessHeap () returned 0x340000 [0038.365] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x353f20, Size=0x7a) returned 0x35a780 [0038.365] GetProcessHeap () returned 0x340000 [0038.365] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x7a) returned 0x35a808 [0038.365] GetProcessHeap () returned 0x340000 [0038.365] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x35a890 [0038.365] GetProcessHeap () returned 0x340000 [0038.365] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x10) returned 0x351658 [0038.365] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x30f894 | out: phkResult=0x30f894*=0xa8) returned 0x0 [0038.365] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x30f890, lpData=0x35a808, lpcbData=0x30f898*=0x7a | out: lpType=0x30f890*=0x2, lpData=0x35a808*=0xc4, lpcbData=0x30f898*=0x98) returned 0xea [0038.365] RegCloseKey (hKey=0xa8) returned 0x0 [0038.365] GetProcessHeap () returned 0x340000 [0038.365] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x351658 | out: hHeap=0x340000) returned 1 [0038.365] GetProcessHeap () returned 0x340000 [0038.365] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a890 | out: hHeap=0x340000) returned 1 [0038.365] GetProcessHeap () returned 0x340000 [0038.365] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a808 | out: hHeap=0x340000) returned 1 [0038.365] GetProcessHeap () returned 0x340000 [0038.365] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x35a780, Size=0xf2) returned 0x35a780 [0038.365] GetProcessHeap () returned 0x340000 [0038.365] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0xf2) returned 0x35a880 [0038.365] GetProcessHeap () returned 0x340000 [0038.365] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x35a980 [0038.365] GetProcessHeap () returned 0x340000 [0038.365] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x10) returned 0x351658 [0038.365] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x30f894 | out: phkResult=0x30f894*=0xa8) returned 0x0 [0038.366] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x30f890, lpData=0x35a880, lpcbData=0x30f898*=0xf2 | out: lpType=0x30f890*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x30f898*=0x98) returned 0x0 [0038.366] RegCloseKey (hKey=0xa8) returned 0x0 [0038.366] GetProcessHeap () returned 0x340000 [0038.366] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x351658 | out: hHeap=0x340000) returned 1 [0038.366] GetProcessHeap () returned 0x340000 [0038.366] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x359f30 [0038.366] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x30f894 | out: phkResult=0x30f894*=0xa8) returned 0x0 [0038.366] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x30f890, lpData=0x35a918, lpcbData=0x30f898*=0x5a | out: lpType=0x30f890*=0x0, lpData=0x35a918*=0x73, lpcbData=0x30f898*=0x5a) returned 0x2 [0038.366] RegCloseKey (hKey=0xa8) returned 0x0 [0038.366] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x30f8a8 | out: phkResult=0x30f8a8*=0xa8) returned 0x0 [0038.366] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x30f8a4, lpData=0x35a918, lpcbData=0x30f8ac*=0x5a | out: lpType=0x30f8a4*=0x2, lpData=0x35a918*=0x73, lpcbData=0x30f8ac*=0x78) returned 0xea [0038.366] RegCloseKey (hKey=0xa8) returned 0x0 [0038.366] GetProcessHeap () returned 0x340000 [0038.366] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x359f30 | out: hHeap=0x340000) returned 1 [0038.366] GetProcessHeap () returned 0x340000 [0038.366] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a980 | out: hHeap=0x340000) returned 1 [0038.367] GetProcessHeap () returned 0x340000 [0038.367] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a880 | out: hHeap=0x340000) returned 1 [0038.367] GetProcessHeap () returned 0x340000 [0038.367] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x35a780, Size=0x1e2) returned 0x35a780 [0038.367] GetProcessHeap () returned 0x340000 [0038.367] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1e2) returned 0x35a970 [0038.367] GetProcessHeap () returned 0x340000 [0038.367] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x35ab60 [0038.367] GetProcessHeap () returned 0x340000 [0038.367] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x10) returned 0x351658 [0038.367] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x30f894 | out: phkResult=0x30f894*=0xa8) returned 0x0 [0038.367] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x30f890, lpData=0x35a970, lpcbData=0x30f898*=0x1e2 | out: lpType=0x30f890*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x30f898*=0x98) returned 0x0 [0038.367] RegCloseKey (hKey=0xa8) returned 0x0 [0038.367] GetProcessHeap () returned 0x340000 [0038.367] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x351658 | out: hHeap=0x340000) returned 1 [0038.368] GetProcessHeap () returned 0x340000 [0038.368] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x359f30 [0038.368] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x30f894 | out: phkResult=0x30f894*=0xa8) returned 0x0 [0038.368] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x30f890, lpData=0x35aa08, lpcbData=0x30f898*=0x14a | out: lpType=0x30f890*=0x0, lpData=0x35aa08*=0x73, lpcbData=0x30f898*=0x14a) returned 0x2 [0038.368] RegCloseKey (hKey=0xa8) returned 0x0 [0038.368] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x30f8a8 | out: phkResult=0x30f8a8*=0xa8) returned 0x0 [0038.368] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x30f8a4, lpData=0x35aa08, lpcbData=0x30f8ac*=0x14a | out: lpType=0x30f8a4*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x30f8ac*=0x78) returned 0x0 [0038.368] RegCloseKey (hKey=0xa8) returned 0x0 [0038.368] GetProcessHeap () returned 0x340000 [0038.368] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x359f30 | out: hHeap=0x340000) returned 1 [0038.369] GetProcessHeap () returned 0x340000 [0038.369] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35ab60 | out: hHeap=0x340000) returned 1 [0038.369] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0x35a780, nSize=0xf1 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x99 [0038.369] GetProcessHeap () returned 0x340000 [0038.369] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a970 | out: hHeap=0x340000) returned 1 [0038.369] GetProcessHeap () returned 0x340000 [0038.369] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x353ed8 | out: hHeap=0x340000) returned 1 [0038.369] GetProcessHeap () returned 0x340000 [0038.369] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20a) returned 0x35a970 [0038.369] GetProcessHeap () returned 0x340000 [0038.369] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20a) returned 0x35ab88 [0038.369] GetProcessHeap () returned 0x340000 [0038.369] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20a) returned 0x35ada0 [0038.369] GetProcessHeap () returned 0x340000 [0038.369] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20a) returned 0x35afb8 [0038.369] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x35a970, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cusersnextadminappdatalocalfast.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersnextadminappdatalocalfast.exe")) returned 0x49 [0038.369] GetProcessHeap () returned 0x340000 [0038.370] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20a) returned 0x35b1d0 [0038.370] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x35b1d0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cusersnextadminappdatalocalfast.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersnextadminappdatalocalfast.exe")) returned 0x49 [0038.370] GetProcessHeap () returned 0x340000 [0038.370] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35b1d0 | out: hHeap=0x340000) returned 1 [0038.370] GetProcessHeap () returned 0x340000 [0038.370] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20a) returned 0x35b1d0 [0038.370] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x35b1d0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cusersnextadminappdatalocalfast.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersnextadminappdatalocalfast.exe")) returned 0x49 [0038.370] GetProcessHeap () returned 0x340000 [0038.370] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35b1d0 | out: hHeap=0x340000) returned 1 [0038.370] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cusersnextadminappdatalocalfast.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersnextadminappdatalocalfast.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cusersnextadminappdatalocalfast.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\cusersnextadminappdatalocalfast.exe"), bFailIfExists=0) returned 1 [0038.377] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x30f990 | out: phkResult=0x30f990*=0xac) returned 0x0 [0038.378] RegSetValueExW (hKey=0xac, lpValueName="cusersnextadminappdatalocalfast", Reserved=0x0, dwType=0x1, lpData=0x35ab88, cbData=0x9e) returned 0x5 [0038.378] RegCloseKey (hKey=0xac) returned 0x0 [0038.378] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x30f98c | out: phkResult=0x30f98c*=0xac) returned 0x0 [0038.378] RegSetValueExW (in: hKey=0xac, lpValueName="cusersnextadminappdatalocalfast", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cusersnextadminappdatalocalfast.exe", cbData=0x9e | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\cusersnextadminappdatalocalfast.exe") returned 0x0 [0038.380] RegCloseKey (hKey=0xac) returned 0x0 [0038.380] GetProcessHeap () returned 0x340000 [0038.380] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x134) returned 0x35b1d0 [0038.380] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cusersnextadminappdatalocalfast.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersnextadminappdatalocalfast.exe"), lpNewFileName="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersnextadminappdatalocalfast.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersnextadminappdatalocalfast.exe"), bFailIfExists=1) returned 1 [0038.386] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cusersnextadminappdatalocalfast.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersnextadminappdatalocalfast.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersnextadminappdatalocalfast.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersnextadminappdatalocalfast.exe"), bFailIfExists=1) returned 0 [0038.388] GetProcessHeap () returned 0x340000 [0038.388] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35b1d0 | out: hHeap=0x340000) returned 1 [0038.388] GetProcessHeap () returned 0x340000 [0038.388] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a970 | out: hHeap=0x340000) returned 1 [0038.388] GetProcessHeap () returned 0x340000 [0038.388] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35ab88 | out: hHeap=0x340000) returned 1 [0038.388] GetProcessHeap () returned 0x340000 [0038.388] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35ada0 | out: hHeap=0x340000) returned 1 [0038.388] GetProcessHeap () returned 0x340000 [0038.388] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35afb8 | out: hHeap=0x340000) returned 1 [0038.388] GetProcessHeap () returned 0x340000 [0038.388] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a718 | out: hHeap=0x340000) returned 1 [0038.388] GetProcessHeap () returned 0x340000 [0038.388] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x34f868 | out: hHeap=0x340000) returned 1 [0038.388] GetProcessHeap () returned 0x340000 [0038.388] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a780 | out: hHeap=0x340000) returned 1 [0038.388] GetProcessHeap () returned 0x340000 [0038.388] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x359f30 [0038.388] GetProcessHeap () returned 0x340000 [0038.388] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x359f58 [0038.388] GetProcessHeap () returned 0x340000 [0038.388] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1e) returned 0x359f80 [0038.388] GetProcessHeap () returned 0x340000 [0038.388] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x35a718 [0038.388] GetProcessHeap () returned 0x340000 [0038.388] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a718 | out: hHeap=0x340000) returned 1 [0038.388] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x359f58, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0038.388] GetProcessHeap () returned 0x340000 [0038.388] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x359f80 | out: hHeap=0x340000) returned 1 [0038.388] GetProcessHeap () returned 0x340000 [0038.389] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x359f30 | out: hHeap=0x340000) returned 1 [0038.389] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x30f9ac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x30f9ac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0038.389] GetProcessHeap () returned 0x340000 [0038.389] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x359f58 | out: hHeap=0x340000) returned 1 [0038.389] GetProcessHeap () returned 0x340000 [0038.389] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x28) returned 0x35a718 [0038.389] GetProcessHeap () returned 0x340000 [0038.389] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x351658 [0038.389] GetProcessHeap () returned 0x340000 [0038.389] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x190) returned 0x35a748 [0038.389] GetProcessHeap () returned 0x340000 [0038.389] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x70) returned 0x35a8e0 [0038.389] GetProcessHeap () returned 0x340000 [0038.389] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x6e) returned 0x35a958 [0038.389] GetProcessHeap () returned 0x340000 [0038.389] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x35a958, Size=0xda) returned 0x35a958 [0038.389] GetProcessHeap () returned 0x340000 [0038.389] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x184) returned 0x35aa40 [0038.389] GetProcessHeap () returned 0x340000 [0038.389] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x351688 [0038.389] GetProcessHeap () returned 0x340000 [0038.389] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20a) returned 0x35abd0 [0038.389] GetProcessHeap () returned 0x340000 [0038.389] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x250) returned 0x35ade8 [0038.389] GetProcessHeap () returned 0x340000 [0038.389] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0xa0) returned 0x35b040 [0038.389] GetProcessHeap () returned 0x340000 [0038.389] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x96) returned 0x35b0e8 [0038.389] GetProcessHeap () returned 0x340000 [0038.389] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x96) returned 0x35b188 [0038.390] GetProcessHeap () returned 0x340000 [0038.390] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x35b228 [0038.390] GetProcessHeap () returned 0x340000 [0038.390] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35b228 | out: hHeap=0x340000) returned 1 [0038.390] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;tlup.txt", lpDst=0x35b0e8, nSize=0x4b | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;tlup.txt") returned 0x4b [0038.390] GetProcessHeap () returned 0x340000 [0038.390] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35b188 | out: hHeap=0x340000) returned 1 [0038.390] GetProcessHeap () returned 0x340000 [0038.390] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35b040 | out: hHeap=0x340000) returned 1 [0038.390] GetProcessHeap () returned 0x340000 [0038.390] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x70) returned 0x35b040 [0038.390] GetProcessHeap () returned 0x340000 [0038.390] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x62) returned 0x35b188 [0038.390] GetProcessHeap () returned 0x340000 [0038.390] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x62) returned 0x35b1f8 [0038.390] GetProcessHeap () returned 0x340000 [0038.390] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x35b268 [0038.390] GetProcessHeap () returned 0x340000 [0038.390] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35b268 | out: hHeap=0x340000) returned 1 [0038.390] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x35b188, nSize=0x31 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0038.390] GetProcessHeap () returned 0x340000 [0038.390] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35b1f8 | out: hHeap=0x340000) returned 1 [0038.390] GetProcessHeap () returned 0x340000 [0038.390] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x35b188, Size=0xc2) returned 0x35b188 [0038.390] GetProcessHeap () returned 0x340000 [0038.390] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0xc2) returned 0x35b258 [0038.390] GetProcessHeap () returned 0x340000 [0038.390] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x35b328 [0038.390] GetProcessHeap () returned 0x340000 [0038.390] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35b328 | out: hHeap=0x340000) returned 1 [0038.390] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x35b188, nSize=0x61 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0038.390] GetProcessHeap () returned 0x340000 [0038.391] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35b258 | out: hHeap=0x340000) returned 1 [0038.391] GetProcessHeap () returned 0x340000 [0038.391] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35b040 | out: hHeap=0x340000) returned 1 [0038.391] GetProcessHeap () returned 0x340000 [0038.391] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20a) returned 0x35b258 [0038.391] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x35b258, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cusersnextadminappdatalocalfast.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersnextadminappdatalocalfast.exe")) returned 0x49 [0038.391] GetProcessHeap () returned 0x340000 [0038.391] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35b258 | out: hHeap=0x340000) returned 1 [0038.391] GetProcessHeap () returned 0x340000 [0038.391] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x24e) returned 0x35b258 [0038.391] GetProcessHeap () returned 0x340000 [0038.391] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x35b258, Size=0x3cc) returned 0x35b258 [0038.391] GetProcessHeap () returned 0x340000 [0038.391] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x98) returned 0x35b040 [0038.391] GetProcessHeap () returned 0x340000 [0038.391] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x35b040, Size=0xe0) returned 0x35b630 [0038.391] GetProcessHeap () returned 0x340000 [0038.391] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x6a) returned 0x35b040 [0038.391] GetProcessHeap () returned 0x340000 [0038.391] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35abd0 | out: hHeap=0x340000) returned 1 [0038.391] GetProcessHeap () returned 0x340000 [0038.391] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35ade8 | out: hHeap=0x340000) returned 1 [0038.391] GetProcessHeap () returned 0x340000 [0038.391] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35b0e8 | out: hHeap=0x340000) returned 1 [0038.391] GetProcessHeap () returned 0x340000 [0038.391] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35b188 | out: hHeap=0x340000) returned 1 [0038.391] GetProcessHeap () returned 0x340000 [0038.391] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x351658 | out: hHeap=0x340000) returned 1 [0038.391] GetProcessHeap () returned 0x340000 [0038.391] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a748 | out: hHeap=0x340000) returned 1 [0038.391] GetProcessHeap () returned 0x340000 [0038.391] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a8e0 | out: hHeap=0x340000) returned 1 [0038.391] GetProcessHeap () returned 0x340000 [0038.391] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35aa40 | out: hHeap=0x340000) returned 1 [0038.391] GetProcessHeap () returned 0x340000 [0038.391] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x359f30 [0038.392] GetProcessHeap () returned 0x340000 [0038.392] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x359f58 [0038.392] GetProcessHeap () returned 0x340000 [0038.392] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1e) returned 0x359f80 [0038.392] GetProcessHeap () returned 0x340000 [0038.392] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x35b0b8 [0038.392] GetProcessHeap () returned 0x340000 [0038.392] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35b0b8 | out: hHeap=0x340000) returned 1 [0038.392] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x359f58, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0038.392] GetProcessHeap () returned 0x340000 [0038.392] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x359f80 | out: hHeap=0x340000) returned 1 [0038.392] GetProcessHeap () returned 0x340000 [0038.392] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x359f30 | out: hHeap=0x340000) returned 1 [0038.392] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x30f9ac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x30f9ac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0038.392] GetProcessHeap () returned 0x340000 [0038.392] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x359f58 | out: hHeap=0x340000) returned 1 [0038.392] GetProcessHeap () returned 0x340000 [0038.392] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x28) returned 0x35b0b8 [0038.392] GetProcessHeap () returned 0x340000 [0038.392] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x351658 [0038.392] GetProcessHeap () returned 0x340000 [0038.392] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x190) returned 0x35a748 [0038.392] GetProcessHeap () returned 0x340000 [0038.392] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x70) returned 0x35a8e0 [0038.392] GetProcessHeap () returned 0x340000 [0038.392] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x6e) returned 0x35b0e8 [0038.392] GetProcessHeap () returned 0x340000 [0038.392] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x35b0e8, Size=0xda) returned 0x35b0e8 [0038.392] GetProcessHeap () returned 0x340000 [0038.392] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x184) returned 0x35aa40 [0038.392] GetProcessHeap () returned 0x340000 [0038.393] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3516a0 [0038.393] GetProcessHeap () returned 0x340000 [0038.393] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20a) returned 0x35abd0 [0038.393] GetProcessHeap () returned 0x340000 [0038.393] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x250) returned 0x35ade8 [0038.393] GetProcessHeap () returned 0x340000 [0038.393] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0xa0) returned 0x35b718 [0038.393] GetProcessHeap () returned 0x340000 [0038.393] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x96) returned 0x35b7c0 [0038.393] GetProcessHeap () returned 0x340000 [0038.393] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x96) returned 0x35b860 [0038.393] GetProcessHeap () returned 0x340000 [0038.393] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x35b900 [0038.393] GetProcessHeap () returned 0x340000 [0038.393] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35b900 | out: hHeap=0x340000) returned 1 [0038.393] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;tlup.txt", lpDst=0x35b7c0, nSize=0x4b | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;tlup.txt") returned 0x4b [0038.393] GetProcessHeap () returned 0x340000 [0038.393] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35b860 | out: hHeap=0x340000) returned 1 [0038.393] GetProcessHeap () returned 0x340000 [0038.393] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35b718 | out: hHeap=0x340000) returned 1 [0038.393] GetProcessHeap () returned 0x340000 [0038.393] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x70) returned 0x35b1d0 [0038.393] GetProcessHeap () returned 0x340000 [0038.393] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x62) returned 0x35b718 [0038.393] GetProcessHeap () returned 0x340000 [0038.393] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x62) returned 0x35b860 [0038.393] GetProcessHeap () returned 0x340000 [0038.393] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x35b8d0 [0038.393] GetProcessHeap () returned 0x340000 [0038.393] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35b8d0 | out: hHeap=0x340000) returned 1 [0038.393] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x35b718, nSize=0x31 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0038.393] GetProcessHeap () returned 0x340000 [0038.393] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35b860 | out: hHeap=0x340000) returned 1 [0038.394] GetProcessHeap () returned 0x340000 [0038.394] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x35b718, Size=0xc2) returned 0x35b860 [0038.394] GetProcessHeap () returned 0x340000 [0038.394] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0xc2) returned 0x35b930 [0038.394] GetProcessHeap () returned 0x340000 [0038.394] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x35b718 [0038.394] GetProcessHeap () returned 0x340000 [0038.394] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35b718 | out: hHeap=0x340000) returned 1 [0038.394] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x35b860, nSize=0x61 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0038.394] GetProcessHeap () returned 0x340000 [0038.394] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35b930 | out: hHeap=0x340000) returned 1 [0038.394] GetProcessHeap () returned 0x340000 [0038.394] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35b1d0 | out: hHeap=0x340000) returned 1 [0038.394] GetProcessHeap () returned 0x340000 [0038.394] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20a) returned 0x35b930 [0038.394] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x35b930, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cusersnextadminappdatalocalfast.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersnextadminappdatalocalfast.exe")) returned 0x49 [0038.394] GetProcessHeap () returned 0x340000 [0038.394] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35b930 | out: hHeap=0x340000) returned 1 [0038.394] GetProcessHeap () returned 0x340000 [0038.394] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x182) returned 0x35b930 [0038.394] GetProcessHeap () returned 0x340000 [0038.394] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x24e) returned 0x35bac0 [0038.394] GetProcessHeap () returned 0x340000 [0038.394] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x98) returned 0x35b718 [0038.394] GetProcessHeap () returned 0x340000 [0038.394] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x35b718, Size=0xe0) returned 0x35bd18 [0038.394] GetProcessHeap () returned 0x340000 [0038.394] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x6a) returned 0x35b1d0 [0038.394] GetProcessHeap () returned 0x340000 [0038.394] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35abd0 | out: hHeap=0x340000) returned 1 [0038.394] GetProcessHeap () returned 0x340000 [0038.394] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35ade8 | out: hHeap=0x340000) returned 1 [0038.394] GetProcessHeap () returned 0x340000 [0038.395] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35b7c0 | out: hHeap=0x340000) returned 1 [0038.395] GetProcessHeap () returned 0x340000 [0038.395] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35b860 | out: hHeap=0x340000) returned 1 [0038.395] GetProcessHeap () returned 0x340000 [0038.395] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x351658 | out: hHeap=0x340000) returned 1 [0038.395] GetProcessHeap () returned 0x340000 [0038.395] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a748 | out: hHeap=0x340000) returned 1 [0038.395] GetProcessHeap () returned 0x340000 [0038.395] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a8e0 | out: hHeap=0x340000) returned 1 [0038.395] GetProcessHeap () returned 0x340000 [0038.395] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35aa40 | out: hHeap=0x340000) returned 1 [0038.395] GetProcessHeap () returned 0x340000 [0038.395] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x14) returned 0x351850 [0038.395] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12621e5, lpParameter=0x351850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa8 [0038.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1262291, lpParameter=0x30f9e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac [0038.396] GetProcessHeap () returned 0x340000 [0038.396] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x14) returned 0x35a788 [0038.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1262058, lpParameter=0x35a788, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb0 [0038.397] GetProcessHeap () returned 0x340000 [0038.397] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x14) returned 0x35a7c8 [0038.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x126196d, lpParameter=0x35a7c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb4 [0038.398] GetProcessHeap () returned 0x340000 [0038.398] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x14) returned 0x35a808 [0038.398] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1261bbc, lpParameter=0x35a808, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb8 [0038.399] WaitForSingleObject (hHandle=0xb4, dwMilliseconds=0xffffffff) returned 0x0 [0040.036] WaitForMultipleObjects (nCount=0x4, lpHandles=0x30fa40*=0xa8, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 4 os_tid = 0x358 [0038.399] GetProcessHeap () returned 0x340000 [0038.399] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x440) returned 0x35aa40 [0038.399] GetProcessHeap () returned 0x340000 [0038.399] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x30) returned 0x35a848 [0038.399] GetCurrentProcess () returned 0xffffffff [0038.399] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0xadfa80 | out: TokenHandle=0xadfa80*=0xbc) returned 1 [0038.417] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0xadfa78 | out: lpLuid=0xadfa78*(LowPart=0x14, HighPart=0)) returned 1 [0038.440] AdjustTokenPrivileges (in: TokenHandle=0xbc, DisableAllPrivileges=0, NewState=0xadfa68*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0038.440] CloseHandle (hObject=0xbc) returned 1 [0038.440] GetProcessHeap () returned 0x340000 [0038.440] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a848 | out: hHeap=0x340000) returned 1 [0038.440] GetProcessHeap () returned 0x340000 [0038.440] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x434) returned 0x3765b8 [0038.441] GetProcessHeap () returned 0x340000 [0038.441] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3765b8 | out: hHeap=0x340000) returned 1 [0038.441] GetProcessHeap () returned 0x340000 [0038.441] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35aa40 | out: hHeap=0x340000) returned 1 [0038.441] GetProcessHeap () returned 0x340000 [0038.441] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x351850 | out: hHeap=0x340000) returned 1 Thread: id = 5 os_tid = 0x7b4 [0038.422] GetVersion () returned 0x1db10106 [0038.422] GetCurrentProcess () returned 0xffffffff [0038.422] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x99fecc | out: TokenHandle=0x99fecc*=0xfc) returned 1 [0038.422] GetTokenInformation (in: TokenHandle=0xfc, TokenInformationClass=0x14, TokenInformation=0x99fec4, TokenInformationLength=0x4, ReturnLength=0x99fec8 | out: TokenInformation=0x99fec4, ReturnLength=0x99fec8) returned 1 [0038.422] CloseHandle (hObject=0xfc) returned 1 [0038.422] GetProcessHeap () returned 0x340000 [0038.422] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x35a278 [0038.422] GetProcessHeap () returned 0x340000 [0038.423] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x35a390 [0038.423] GetProcessHeap () returned 0x340000 [0038.423] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1e) returned 0x35a3b8 [0038.423] GetProcessHeap () returned 0x340000 [0038.423] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x361470 [0038.423] GetProcessHeap () returned 0x340000 [0038.423] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x361470 | out: hHeap=0x340000) returned 1 [0038.423] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x35a390, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0038.423] GetProcessHeap () returned 0x340000 [0038.423] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a3b8 | out: hHeap=0x340000) returned 1 [0038.423] GetProcessHeap () returned 0x340000 [0038.423] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a278 | out: hHeap=0x340000) returned 1 [0038.423] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x99fe54, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x99fe54*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0038.424] GetProcessHeap () returned 0x340000 [0038.424] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a390 | out: hHeap=0x340000) returned 1 [0038.424] GetProcessHeap () returned 0x340000 [0038.424] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x353fb0 [0038.424] GetProcessHeap () returned 0x340000 [0038.424] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3a) returned 0x353ff8 [0038.424] GetProcessHeap () returned 0x340000 [0038.424] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x353ff8, Size=0x72) returned 0x34f868 [0038.424] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0xfc [0038.424] WaitForSingleObject (hHandle=0xfc, dwMilliseconds=0x0) returned 0x102 [0038.424] CloseHandle (hObject=0xfc) returned 1 [0038.424] GetProcessHeap () returned 0x340000 [0038.424] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x353fb0 | out: hHeap=0x340000) returned 1 [0038.424] GetProcessHeap () returned 0x340000 [0038.424] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x34f868 | out: hHeap=0x340000) returned 1 [0038.424] Sleep (dwMilliseconds=0x3e8) [0040.476] GetProcessHeap () returned 0x340000 [0040.476] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x35a4f8 [0040.476] GetProcessHeap () returned 0x340000 [0040.477] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x35a520 [0040.477] GetProcessHeap () returned 0x340000 [0040.477] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1e) returned 0x35a548 [0040.477] GetProcessHeap () returned 0x340000 [0040.477] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x35a7c8 [0040.477] GetProcessHeap () returned 0x340000 [0040.477] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a7c8 | out: hHeap=0x340000) returned 1 [0040.477] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x35a520, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0040.477] GetProcessHeap () returned 0x340000 [0040.477] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a548 | out: hHeap=0x340000) returned 1 [0040.477] GetProcessHeap () returned 0x340000 [0040.477] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a4f8 | out: hHeap=0x340000) returned 1 [0040.477] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x99fe54, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x99fe54*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0040.478] GetProcessHeap () returned 0x340000 [0040.478] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a520 | out: hHeap=0x340000) returned 1 [0040.478] GetProcessHeap () returned 0x340000 [0040.478] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x3541a8 [0040.478] GetProcessHeap () returned 0x340000 [0040.478] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3a) returned 0x3541f0 [0040.478] GetProcessHeap () returned 0x340000 [0040.478] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x3541f0, Size=0x72) returned 0x34fa68 [0040.478] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x118 [0040.478] WaitForSingleObject (hHandle=0x118, dwMilliseconds=0x0) returned 0x102 [0040.478] CloseHandle (hObject=0x118) returned 1 [0040.478] GetProcessHeap () returned 0x340000 [0040.478] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3541a8 | out: hHeap=0x340000) returned 1 [0040.478] GetProcessHeap () returned 0x340000 [0040.478] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x34fa68 | out: hHeap=0x340000) returned 1 [0040.478] Sleep (dwMilliseconds=0x3e8) [0041.723] GetProcessHeap () returned 0x340000 [0041.723] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x35a660 [0041.723] GetProcessHeap () returned 0x340000 [0041.723] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x35a570 [0041.723] GetProcessHeap () returned 0x340000 [0041.723] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1e) returned 0x35a598 [0041.723] GetProcessHeap () returned 0x340000 [0041.723] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x378940 [0041.723] GetProcessHeap () returned 0x340000 [0041.723] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378940 | out: hHeap=0x340000) returned 1 [0041.723] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x35a570, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0041.723] GetProcessHeap () returned 0x340000 [0041.723] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a598 | out: hHeap=0x340000) returned 1 [0041.723] GetProcessHeap () returned 0x340000 [0041.723] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a660 | out: hHeap=0x340000) returned 1 [0041.724] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x99fe54, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x99fe54*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0041.724] GetProcessHeap () returned 0x340000 [0041.724] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a570 | out: hHeap=0x340000) returned 1 [0041.724] GetProcessHeap () returned 0x340000 [0041.724] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x3542c8 [0041.724] GetProcessHeap () returned 0x340000 [0041.724] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3a) returned 0x354310 [0041.724] GetProcessHeap () returned 0x340000 [0041.724] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x354310, Size=0x72) returned 0x34fb68 [0041.724] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x130 [0041.724] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x0) returned 0x102 [0041.725] CloseHandle (hObject=0x130) returned 1 [0041.725] GetProcessHeap () returned 0x340000 [0041.725] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3542c8 | out: hHeap=0x340000) returned 1 [0041.725] GetProcessHeap () returned 0x340000 [0041.725] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x34fb68 | out: hHeap=0x340000) returned 1 [0041.725] Sleep (dwMilliseconds=0x3e8) [0043.205] GetProcessHeap () returned 0x340000 [0043.205] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x378c10 [0043.205] GetProcessHeap () returned 0x340000 [0043.205] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x378d00 [0043.205] GetProcessHeap () returned 0x340000 [0043.206] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1e) returned 0x378d28 [0043.206] GetProcessHeap () returned 0x340000 [0043.206] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x37c180 [0043.206] GetProcessHeap () returned 0x340000 [0043.206] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x37c180 | out: hHeap=0x340000) returned 1 [0043.206] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x378d00, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0043.206] GetProcessHeap () returned 0x340000 [0043.206] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378d28 | out: hHeap=0x340000) returned 1 [0043.206] GetProcessHeap () returned 0x340000 [0043.206] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378c10 | out: hHeap=0x340000) returned 1 [0043.206] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x99fe54, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x99fe54*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0043.206] GetProcessHeap () returned 0x340000 [0043.206] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378d00 | out: hHeap=0x340000) returned 1 [0043.206] GetProcessHeap () returned 0x340000 [0043.206] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x354358 [0043.206] GetProcessHeap () returned 0x340000 [0043.206] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3a) returned 0x3543a0 [0043.206] GetProcessHeap () returned 0x340000 [0043.206] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x3543a0, Size=0x72) returned 0x34fd68 [0043.206] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x160 [0043.207] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x0) returned 0x102 [0043.207] CloseHandle (hObject=0x160) returned 1 [0043.207] GetProcessHeap () returned 0x340000 [0043.207] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x354358 | out: hHeap=0x340000) returned 1 [0043.207] GetProcessHeap () returned 0x340000 [0043.207] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x34fd68 | out: hHeap=0x340000) returned 1 [0043.207] Sleep (dwMilliseconds=0x3e8) [0044.375] GetProcessHeap () returned 0x340000 [0044.375] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x378c10 [0044.375] GetProcessHeap () returned 0x340000 [0044.375] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x378d78 [0044.375] GetProcessHeap () returned 0x340000 [0044.375] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1e) returned 0x378d00 [0044.375] GetProcessHeap () returned 0x340000 [0044.375] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x37c6c8 [0044.376] GetProcessHeap () returned 0x340000 [0044.376] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x37c6c8 | out: hHeap=0x340000) returned 1 [0044.376] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x378d78, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0044.376] GetProcessHeap () returned 0x340000 [0044.376] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378d00 | out: hHeap=0x340000) returned 1 [0044.376] GetProcessHeap () returned 0x340000 [0044.376] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378c10 | out: hHeap=0x340000) returned 1 [0044.376] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x99fe54, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x99fe54*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0044.379] GetProcessHeap () returned 0x340000 [0044.379] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378d78 | out: hHeap=0x340000) returned 1 [0044.379] GetProcessHeap () returned 0x340000 [0044.379] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x3543a0 [0044.379] GetProcessHeap () returned 0x340000 [0044.379] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3a) returned 0x3543e8 [0044.379] GetProcessHeap () returned 0x340000 [0044.379] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x3543e8, Size=0x72) returned 0x34fd68 [0044.379] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0044.380] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0044.380] CloseHandle (hObject=0x170) returned 1 [0044.380] GetProcessHeap () returned 0x340000 [0044.380] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3543a0 | out: hHeap=0x340000) returned 1 [0044.380] GetProcessHeap () returned 0x340000 [0044.380] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x34fd68 | out: hHeap=0x340000) returned 1 [0044.380] Sleep (dwMilliseconds=0x3e8) [0048.848] GetProcessHeap () returned 0x340000 [0048.848] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x378d78 [0048.849] GetProcessHeap () returned 0x340000 [0048.849] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x378c10 [0048.849] GetProcessHeap () returned 0x340000 [0048.849] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1e) returned 0x378d00 [0048.849] GetProcessHeap () returned 0x340000 [0048.849] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x37c6c8 [0048.849] GetProcessHeap () returned 0x340000 [0048.849] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x37c6c8 | out: hHeap=0x340000) returned 1 [0048.849] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x378c10, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0048.849] GetProcessHeap () returned 0x340000 [0048.849] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378d00 | out: hHeap=0x340000) returned 1 [0048.850] GetProcessHeap () returned 0x340000 [0048.850] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378d78 | out: hHeap=0x340000) returned 1 [0048.850] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x99fe54, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x99fe54*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0048.851] GetProcessHeap () returned 0x340000 [0048.851] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378c10 | out: hHeap=0x340000) returned 1 [0048.851] GetProcessHeap () returned 0x340000 [0048.851] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x3543a0 [0048.851] GetProcessHeap () returned 0x340000 [0048.851] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3a) returned 0x3543e8 [0048.851] GetProcessHeap () returned 0x340000 [0048.851] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x3543e8, Size=0x72) returned 0x34fd68 [0048.851] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0048.852] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0048.852] CloseHandle (hObject=0x170) returned 1 [0048.852] GetProcessHeap () returned 0x340000 [0048.852] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3543a0 | out: hHeap=0x340000) returned 1 [0048.852] GetProcessHeap () returned 0x340000 [0048.852] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x34fd68 | out: hHeap=0x340000) returned 1 [0048.852] Sleep (dwMilliseconds=0x3e8) [0049.993] GetProcessHeap () returned 0x340000 [0049.993] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x378c10 [0049.993] GetProcessHeap () returned 0x340000 [0049.993] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x378d78 [0049.993] GetProcessHeap () returned 0x340000 [0049.993] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1e) returned 0x378d00 [0049.993] GetProcessHeap () returned 0x340000 [0049.993] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x37c6c8 [0049.993] GetProcessHeap () returned 0x340000 [0049.993] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x37c6c8 | out: hHeap=0x340000) returned 1 [0049.993] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x378d78, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0049.994] GetProcessHeap () returned 0x340000 [0049.994] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378d00 | out: hHeap=0x340000) returned 1 [0049.994] GetProcessHeap () returned 0x340000 [0049.994] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378c10 | out: hHeap=0x340000) returned 1 [0049.994] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x99fe54, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x99fe54*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0049.994] GetProcessHeap () returned 0x340000 [0049.994] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378d78 | out: hHeap=0x340000) returned 1 [0049.994] GetProcessHeap () returned 0x340000 [0049.994] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x3543a0 [0049.994] GetProcessHeap () returned 0x340000 [0049.994] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3a) returned 0x3543e8 [0049.994] GetProcessHeap () returned 0x340000 [0049.994] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x3543e8, Size=0x72) returned 0x34fd68 [0049.995] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0049.995] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0049.995] CloseHandle (hObject=0x170) returned 1 [0049.995] GetProcessHeap () returned 0x340000 [0049.995] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3543a0 | out: hHeap=0x340000) returned 1 [0049.995] GetProcessHeap () returned 0x340000 [0049.995] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x34fd68 | out: hHeap=0x340000) returned 1 [0049.995] Sleep (dwMilliseconds=0x3e8) [0053.054] GetProcessHeap () returned 0x340000 [0053.054] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x378d78 [0053.054] GetProcessHeap () returned 0x340000 [0053.054] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x378c10 [0053.054] GetProcessHeap () returned 0x340000 [0053.054] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1e) returned 0x378d00 [0053.054] GetProcessHeap () returned 0x340000 [0053.054] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x37c6c8 [0053.054] GetProcessHeap () returned 0x340000 [0053.054] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x37c6c8 | out: hHeap=0x340000) returned 1 [0053.054] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x378c10, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0053.054] GetProcessHeap () returned 0x340000 [0053.055] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378d00 | out: hHeap=0x340000) returned 1 [0053.055] GetProcessHeap () returned 0x340000 [0053.055] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378d78 | out: hHeap=0x340000) returned 1 [0053.055] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x99fe54, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x99fe54*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0053.055] GetProcessHeap () returned 0x340000 [0053.055] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378c10 | out: hHeap=0x340000) returned 1 [0053.055] GetProcessHeap () returned 0x340000 [0053.055] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x3543a0 [0053.055] GetProcessHeap () returned 0x340000 [0053.056] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3a) returned 0x3543e8 [0053.056] GetProcessHeap () returned 0x340000 [0053.056] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x3543e8, Size=0x72) returned 0x34fd68 [0053.056] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0053.056] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0053.056] CloseHandle (hObject=0x170) returned 1 [0053.056] GetProcessHeap () returned 0x340000 [0053.056] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3543a0 | out: hHeap=0x340000) returned 1 [0053.056] GetProcessHeap () returned 0x340000 [0053.056] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x34fd68 | out: hHeap=0x340000) returned 1 [0053.057] Sleep (dwMilliseconds=0x3e8) [0055.030] GetProcessHeap () returned 0x340000 [0055.030] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x378c10 [0055.031] GetProcessHeap () returned 0x340000 [0055.031] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x378d78 [0055.031] GetProcessHeap () returned 0x340000 [0055.031] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1e) returned 0x378d00 [0055.031] GetProcessHeap () returned 0x340000 [0055.031] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x37c6c8 [0055.031] GetProcessHeap () returned 0x340000 [0055.031] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x37c6c8 | out: hHeap=0x340000) returned 1 [0055.031] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x378d78, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0055.031] GetProcessHeap () returned 0x340000 [0055.031] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378d00 | out: hHeap=0x340000) returned 1 [0055.031] GetProcessHeap () returned 0x340000 [0055.031] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378c10 | out: hHeap=0x340000) returned 1 [0055.032] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x99fe54, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x99fe54*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0055.032] GetProcessHeap () returned 0x340000 [0055.032] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378d78 | out: hHeap=0x340000) returned 1 [0055.032] GetProcessHeap () returned 0x340000 [0055.032] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x3543a0 [0055.033] GetProcessHeap () returned 0x340000 [0055.033] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3a) returned 0x3543e8 [0055.033] GetProcessHeap () returned 0x340000 [0055.033] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x3543e8, Size=0x72) returned 0x34fd68 [0055.033] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0055.033] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0055.033] CloseHandle (hObject=0x170) returned 1 [0055.033] GetProcessHeap () returned 0x340000 [0055.033] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3543a0 | out: hHeap=0x340000) returned 1 [0055.033] GetProcessHeap () returned 0x340000 [0055.033] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x34fd68 | out: hHeap=0x340000) returned 1 [0055.034] Sleep (dwMilliseconds=0x3e8) [0059.137] GetProcessHeap () returned 0x340000 [0059.143] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x378d78 [0059.143] GetProcessHeap () returned 0x340000 [0059.143] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x378c10 [0059.143] GetProcessHeap () returned 0x340000 [0059.143] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1e) returned 0x378d00 [0059.143] GetProcessHeap () returned 0x340000 [0059.143] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x37c6c8 [0059.159] GetProcessHeap () returned 0x340000 [0059.159] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x37c6c8 | out: hHeap=0x340000) returned 1 [0059.160] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x378c10, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0059.160] GetProcessHeap () returned 0x340000 [0059.160] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378d00 | out: hHeap=0x340000) returned 1 [0059.160] GetProcessHeap () returned 0x340000 [0059.160] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378d78 | out: hHeap=0x340000) returned 1 [0059.160] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x99fe54, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x99fe54*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0059.160] GetProcessHeap () returned 0x340000 [0059.160] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378c10 | out: hHeap=0x340000) returned 1 [0059.160] GetProcessHeap () returned 0x340000 [0059.160] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x3543a0 [0059.160] GetProcessHeap () returned 0x340000 [0059.160] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3a) returned 0x3543e8 [0059.160] GetProcessHeap () returned 0x340000 [0059.160] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x3543e8, Size=0x72) returned 0x34fd68 [0059.161] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0059.161] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0059.161] CloseHandle (hObject=0x170) returned 1 [0059.161] GetProcessHeap () returned 0x340000 [0059.161] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3543a0 | out: hHeap=0x340000) returned 1 [0059.161] GetProcessHeap () returned 0x340000 [0059.161] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x34fd68 | out: hHeap=0x340000) returned 1 [0059.161] Sleep (dwMilliseconds=0x3e8) [0060.834] GetProcessHeap () returned 0x340000 [0060.834] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x378c10 [0060.834] GetProcessHeap () returned 0x340000 [0060.834] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x378d78 [0060.834] GetProcessHeap () returned 0x340000 [0060.834] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1e) returned 0x378d00 [0060.834] GetProcessHeap () returned 0x340000 [0060.835] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x37c6c8 [0060.835] GetProcessHeap () returned 0x340000 [0060.835] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x37c6c8 | out: hHeap=0x340000) returned 1 [0060.835] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x378d78, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0060.835] GetProcessHeap () returned 0x340000 [0060.835] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378d00 | out: hHeap=0x340000) returned 1 [0060.835] GetProcessHeap () returned 0x340000 [0060.835] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378c10 | out: hHeap=0x340000) returned 1 [0060.835] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x99fe54, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x99fe54*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0060.835] GetProcessHeap () returned 0x340000 [0060.835] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378d78 | out: hHeap=0x340000) returned 1 [0060.835] GetProcessHeap () returned 0x340000 [0060.835] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x3543a0 [0060.835] GetProcessHeap () returned 0x340000 [0060.835] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3a) returned 0x3543e8 [0060.835] GetProcessHeap () returned 0x340000 [0060.836] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x3543e8, Size=0x72) returned 0x34fd68 [0060.836] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0060.836] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0060.836] CloseHandle (hObject=0x170) returned 1 [0060.836] GetProcessHeap () returned 0x340000 [0060.836] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3543a0 | out: hHeap=0x340000) returned 1 [0060.836] GetProcessHeap () returned 0x340000 [0060.836] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x34fd68 | out: hHeap=0x340000) returned 1 [0060.836] Sleep (dwMilliseconds=0x3e8) [0061.977] GetProcessHeap () returned 0x340000 [0061.977] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x378d78 [0061.977] GetProcessHeap () returned 0x340000 [0061.977] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x378c10 [0061.977] GetProcessHeap () returned 0x340000 [0061.977] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1e) returned 0x378d00 [0061.977] GetProcessHeap () returned 0x340000 [0061.977] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x37c6c8 [0061.977] GetProcessHeap () returned 0x340000 [0061.977] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x37c6c8 | out: hHeap=0x340000) returned 1 [0061.977] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x378c10, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0061.977] GetProcessHeap () returned 0x340000 [0061.977] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378d00 | out: hHeap=0x340000) returned 1 [0061.977] GetProcessHeap () returned 0x340000 [0061.977] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378d78 | out: hHeap=0x340000) returned 1 [0061.977] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x99fe54, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x99fe54*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0061.978] GetProcessHeap () returned 0x340000 [0061.978] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378c10 | out: hHeap=0x340000) returned 1 [0061.978] GetProcessHeap () returned 0x340000 [0061.978] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x3543a0 [0061.978] GetProcessHeap () returned 0x340000 [0061.978] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3a) returned 0x3543e8 [0061.978] GetProcessHeap () returned 0x340000 [0061.978] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x3543e8, Size=0x72) returned 0x34fd68 [0061.978] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0061.978] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0061.978] CloseHandle (hObject=0x170) returned 1 [0061.978] GetProcessHeap () returned 0x340000 [0061.978] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3543a0 | out: hHeap=0x340000) returned 1 [0061.978] GetProcessHeap () returned 0x340000 [0061.978] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x34fd68 | out: hHeap=0x340000) returned 1 [0061.979] Sleep (dwMilliseconds=0x3e8) [0063.103] GetProcessHeap () returned 0x340000 [0063.103] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x378c10 [0063.103] GetProcessHeap () returned 0x340000 [0063.103] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x378d78 [0063.103] GetProcessHeap () returned 0x340000 [0063.103] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1e) returned 0x378d00 [0063.103] GetProcessHeap () returned 0x340000 [0063.103] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x37c6c8 [0063.103] GetProcessHeap () returned 0x340000 [0063.103] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x37c6c8 | out: hHeap=0x340000) returned 1 [0063.103] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x378d78, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0063.103] GetProcessHeap () returned 0x340000 [0063.103] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378d00 | out: hHeap=0x340000) returned 1 [0063.103] GetProcessHeap () returned 0x340000 [0063.103] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378c10 | out: hHeap=0x340000) returned 1 [0063.103] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x99fe54, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x99fe54*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0063.103] GetProcessHeap () returned 0x340000 [0063.103] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378d78 | out: hHeap=0x340000) returned 1 [0063.103] GetProcessHeap () returned 0x340000 [0063.103] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x3543a0 [0063.103] GetProcessHeap () returned 0x340000 [0063.103] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3a) returned 0x3543e8 [0063.103] GetProcessHeap () returned 0x340000 [0063.104] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x3543e8, Size=0x72) returned 0x34fd68 [0063.104] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0063.104] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0063.104] CloseHandle (hObject=0x170) returned 1 [0063.104] GetProcessHeap () returned 0x340000 [0063.104] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3543a0 | out: hHeap=0x340000) returned 1 [0063.104] GetProcessHeap () returned 0x340000 [0063.104] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x34fd68 | out: hHeap=0x340000) returned 1 [0063.104] Sleep (dwMilliseconds=0x3e8) [0066.051] GetProcessHeap () returned 0x340000 [0066.051] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x378d78 [0066.051] GetProcessHeap () returned 0x340000 [0066.051] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x378c10 [0066.051] GetProcessHeap () returned 0x340000 [0066.051] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1e) returned 0x378d00 [0066.051] GetProcessHeap () returned 0x340000 [0066.051] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x37c6c8 [0066.051] GetProcessHeap () returned 0x340000 [0066.051] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x37c6c8 | out: hHeap=0x340000) returned 1 [0066.051] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x378c10, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0066.051] GetProcessHeap () returned 0x340000 [0066.051] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378d00 | out: hHeap=0x340000) returned 1 [0066.051] GetProcessHeap () returned 0x340000 [0066.051] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378d78 | out: hHeap=0x340000) returned 1 [0066.051] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x99fe54, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x99fe54*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0066.052] GetProcessHeap () returned 0x340000 [0066.052] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378c10 | out: hHeap=0x340000) returned 1 [0066.052] GetProcessHeap () returned 0x340000 [0066.052] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x3543a0 [0066.052] GetProcessHeap () returned 0x340000 [0066.052] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3a) returned 0x3543e8 [0066.052] GetProcessHeap () returned 0x340000 [0066.052] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x3543e8, Size=0x72) returned 0x34fd68 [0066.052] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0066.052] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0066.052] CloseHandle (hObject=0x170) returned 1 [0066.053] GetProcessHeap () returned 0x340000 [0066.053] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3543a0 | out: hHeap=0x340000) returned 1 [0066.053] GetProcessHeap () returned 0x340000 [0066.053] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x34fd68 | out: hHeap=0x340000) returned 1 [0066.053] Sleep (dwMilliseconds=0x3e8) [0069.098] GetProcessHeap () returned 0x340000 [0069.098] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x378c10 [0069.098] GetProcessHeap () returned 0x340000 [0069.098] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x378d78 [0069.098] GetProcessHeap () returned 0x340000 [0069.098] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1e) returned 0x378d00 [0069.098] GetProcessHeap () returned 0x340000 [0069.098] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x37c6c8 [0069.098] GetProcessHeap () returned 0x340000 [0069.098] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x37c6c8 | out: hHeap=0x340000) returned 1 [0069.098] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x378d78, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0069.098] GetProcessHeap () returned 0x340000 [0069.098] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378d00 | out: hHeap=0x340000) returned 1 [0069.098] GetProcessHeap () returned 0x340000 [0069.098] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378c10 | out: hHeap=0x340000) returned 1 [0069.099] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x99fe54, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x99fe54*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0069.101] GetProcessHeap () returned 0x340000 [0069.101] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378d78 | out: hHeap=0x340000) returned 1 [0069.101] GetProcessHeap () returned 0x340000 [0069.101] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x3543a0 [0069.101] GetProcessHeap () returned 0x340000 [0069.101] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3a) returned 0x3543e8 [0069.101] GetProcessHeap () returned 0x340000 [0069.101] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x3543e8, Size=0x72) returned 0x34fd68 [0069.101] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0069.101] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0069.101] CloseHandle (hObject=0x170) returned 1 [0069.102] GetProcessHeap () returned 0x340000 [0069.102] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3543a0 | out: hHeap=0x340000) returned 1 [0069.102] GetProcessHeap () returned 0x340000 [0069.102] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x34fd68 | out: hHeap=0x340000) returned 1 [0069.102] Sleep (dwMilliseconds=0x3e8) [0070.622] GetProcessHeap () returned 0x340000 [0070.622] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x378d78 [0070.622] GetProcessHeap () returned 0x340000 [0070.622] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x378d00 [0070.622] GetProcessHeap () returned 0x340000 [0070.622] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1e) returned 0x378d50 [0070.622] GetProcessHeap () returned 0x340000 [0070.622] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x37c7b8 [0070.622] GetProcessHeap () returned 0x340000 [0070.622] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x37c7b8 | out: hHeap=0x340000) returned 1 [0070.622] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x378d00, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0070.622] GetProcessHeap () returned 0x340000 [0070.622] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378d50 | out: hHeap=0x340000) returned 1 [0070.622] GetProcessHeap () returned 0x340000 [0070.622] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378d78 | out: hHeap=0x340000) returned 1 [0070.623] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x99fe54, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x99fe54*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0070.623] GetProcessHeap () returned 0x340000 [0070.623] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x378d00 | out: hHeap=0x340000) returned 1 [0070.623] GetProcessHeap () returned 0x340000 [0070.623] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x3543a0 [0070.623] GetProcessHeap () returned 0x340000 [0070.623] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3a) returned 0x3543e8 [0070.623] GetProcessHeap () returned 0x340000 [0070.623] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x3543e8, Size=0x72) returned 0x34fd68 [0070.623] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x174 [0070.623] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x0) returned 0x102 [0070.623] CloseHandle (hObject=0x174) returned 1 [0070.623] GetProcessHeap () returned 0x340000 [0070.623] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3543a0 | out: hHeap=0x340000) returned 1 [0070.623] GetProcessHeap () returned 0x340000 [0070.623] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x34fd68 | out: hHeap=0x340000) returned 1 [0070.623] Sleep (dwMilliseconds=0x3e8) Thread: id = 6 os_tid = 0xc4 [0038.425] GetProcessHeap () returned 0x340000 [0038.425] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x21a) returned 0x361680 [0038.425] GetProcessHeap () returned 0x340000 [0038.425] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x28) returned 0x35aff8 [0038.425] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0xfc [0038.425] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x100 [0038.425] GetComputerNameW (in: lpBuffer=0x361690, nSize=0xbffeb0 | out: lpBuffer="XDUWTFONO", nSize=0xbffeb0) returned 1 [0038.425] GetProcessHeap () returned 0x340000 [0038.425] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x26) returned 0x3618a8 [0038.426] GetProcessHeap () returned 0x340000 [0038.426] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4000) returned 0x3618d8 [0038.426] GetProcessHeap () returned 0x340000 [0038.426] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10000) returned 0x3658e0 [0038.427] WNetOpenEnumW (in: dwScope=0x1, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xbffe68 | out: lphEnum=0xbffe68*=0x35b8d8) returned 0x0 [0043.188] WNetEnumResourceW (in: hEnum=0x35b8d8, lpcCount=0xbffe60, lpBuffer=0x3618d8, lpBufferSize=0xbffe6c | out: lpcCount=0xbffe60, lpBuffer=0x3618d8, lpBufferSize=0xbffe6c) returned 0x103 [0043.188] WNetCloseEnum (hEnum=0x35b8d8) returned 0x0 [0043.188] GetProcessHeap () returned 0x340000 [0043.188] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3618d8 | out: hHeap=0x340000) returned 1 [0043.188] GetProcessHeap () returned 0x340000 [0043.188] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3658e0 | out: hHeap=0x340000) returned 1 [0043.188] GetProcessHeap () returned 0x340000 [0043.188] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4000) returned 0x37cd88 [0043.188] GetProcessHeap () returned 0x340000 [0043.189] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10000) returned 0x3618d8 [0043.189] WNetOpenEnumW (in: dwScope=0x4, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xbffe50 | out: lphEnum=0xbffe50*=0x35c210) returned 0x0 [0043.190] WNetEnumResourceW (in: hEnum=0x35c210, lpcCount=0xbffe48, lpBuffer=0x37cd88, lpBufferSize=0xbffe54 | out: lpcCount=0xbffe48, lpBuffer=0x37cd88, lpBufferSize=0xbffe54) returned 0x103 [0043.190] WNetCloseEnum (hEnum=0x35c210) returned 0x0 [0043.190] GetProcessHeap () returned 0x340000 [0043.190] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x37cd88 | out: hHeap=0x340000) returned 1 [0043.190] GetProcessHeap () returned 0x340000 [0043.190] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3618d8 | out: hHeap=0x340000) returned 1 [0043.190] GetProcessHeap () returned 0x340000 [0043.190] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4000) returned 0x37cd88 [0043.190] GetProcessHeap () returned 0x340000 [0043.190] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10000) returned 0x3618d8 [0043.190] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xbffe38 | out: lphEnum=0xbffe38*=0x35b8d8) returned 0x0 [0070.553] WNetEnumResourceW (in: hEnum=0x35b8d8, lpcCount=0xbffe30, lpBuffer=0x37cd88, lpBufferSize=0xbffe3c | out: lpcCount=0xbffe30, lpBuffer=0x37cd88, lpBufferSize=0xbffe3c) returned 0x0 [0070.553] GetProcessHeap () returned 0x340000 [0070.553] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4000) returned 0x3718e0 [0070.553] GetProcessHeap () returned 0x340000 [0070.553] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10000) returned 0x380d90 [0070.554] WNetOpenEnumW (dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x37cd88, lphEnum=0xbffdf8) Thread: id = 7 os_tid = 0x76c [0040.028] GetLogicalDrives () returned 0x4 [0040.029] GetProcessHeap () returned 0x340000 [0040.029] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x354160 [0040.029] GetProcessHeap () returned 0x340000 [0040.029] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x28) returned 0x35ae40 [0040.029] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x110 [0040.029] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x114 [0040.029] GetProcessHeap () returned 0x340000 [0040.029] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x35a4a8 [0040.029] GetProcessHeap () returned 0x340000 [0040.029] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x35a4d0 [0040.029] GetProcessHeap () returned 0x340000 [0040.029] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1e) returned 0x35a4f8 [0040.029] GetProcessHeap () returned 0x340000 [0040.029] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x35ece8 [0040.029] GetProcessHeap () returned 0x340000 [0040.029] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35ece8 | out: hHeap=0x340000) returned 1 [0040.029] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x35a4d0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0040.029] GetProcessHeap () returned 0x340000 [0040.030] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a4f8 | out: hHeap=0x340000) returned 1 [0040.030] GetProcessHeap () returned 0x340000 [0040.030] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a4a8 | out: hHeap=0x340000) returned 1 [0040.030] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xddf8ec, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xddf8ec*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0040.030] GetProcessHeap () returned 0x340000 [0040.030] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a4d0 | out: hHeap=0x340000) returned 1 [0040.030] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0040.030] CloseHandle (hObject=0x114) returned 1 [0040.030] CloseHandle (hObject=0x110) returned 1 [0040.030] GetProcessHeap () returned 0x340000 [0040.030] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35ae40 | out: hHeap=0x340000) returned 1 [0040.031] GetProcessHeap () returned 0x340000 [0040.031] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x354160 | out: hHeap=0x340000) returned 1 [0040.031] GetProcessHeap () returned 0x340000 [0040.031] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a7c8 | out: hHeap=0x340000) returned 1 Thread: id = 8 os_tid = 0x180 [0040.032] GetLogicalDrives () returned 0x4 [0040.032] GetProcessHeap () returned 0x340000 [0040.032] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20) returned 0x35a4d0 [0040.032] GetProcessHeap () returned 0x340000 [0040.032] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x35a4a8 [0040.032] GetProcessHeap () returned 0x340000 [0040.032] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1e) returned 0x35a4f8 [0040.032] GetProcessHeap () returned 0x340000 [0040.032] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x35ece8 [0040.032] GetProcessHeap () returned 0x340000 [0040.032] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35ece8 | out: hHeap=0x340000) returned 1 [0040.032] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x35a4a8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0040.032] GetProcessHeap () returned 0x340000 [0040.032] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a4f8 | out: hHeap=0x340000) returned 1 [0040.032] GetProcessHeap () returned 0x340000 [0040.032] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a4d0 | out: hHeap=0x340000) returned 1 [0040.032] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x101f9ac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x101f9ac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0040.033] GetProcessHeap () returned 0x340000 [0040.033] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a4a8 | out: hHeap=0x340000) returned 1 [0040.033] GetProcessHeap () returned 0x340000 [0040.033] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40) returned 0x354160 [0040.033] GetProcessHeap () returned 0x340000 [0040.033] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x28) returned 0x35a7c8 [0040.033] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x110 [0040.033] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x114 [0040.033] CloseHandle (hObject=0x114) returned 1 [0040.033] CloseHandle (hObject=0x110) returned 1 [0040.033] GetProcessHeap () returned 0x340000 [0040.034] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a7c8 | out: hHeap=0x340000) returned 1 [0040.034] GetProcessHeap () returned 0x340000 [0040.034] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x354160 | out: hHeap=0x340000) returned 1 [0040.034] GetProcessHeap () returned 0x340000 [0040.034] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35a808 | out: hHeap=0x340000) returned 1 Thread: id = 9 os_tid = 0x53c Thread: id = 10 os_tid = 0x604 Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x37688000" os_pid = "0x7dc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x3a4" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 20 os_tid = 0x634 [0053.392] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cf8d0 | out: lpSystemTimeAsFileTime=0x1cf8d0*(dwLowDateTime=0x11451480, dwHighDateTime=0x1d67630)) [0053.392] GetCurrentProcessId () returned 0x7dc [0053.392] GetCurrentThreadId () returned 0x634 [0053.392] GetTickCount () returned 0x114691f [0053.392] QueryPerformanceCounter (in: lpPerformanceCount=0x1cf8d8 | out: lpPerformanceCount=0x1cf8d8*=17339544767) returned 1 [0053.400] GetModuleHandleW (lpModuleName=0x0) returned 0x49ee0000 [0053.401] __set_app_type (_Type=0x1) [0053.401] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49f07810) returned 0x0 [0053.401] __getmainargs (in: _Argc=0x49f2a608, _Argv=0x49f2a618, _Env=0x49f2a610, _DoWildCard=0, _StartInfo=0x49f0e0f4 | out: _Argc=0x49f2a608, _Argv=0x49f2a618, _Env=0x49f2a610) returned 0 [0053.401] GetCurrentThreadId () returned 0x634 [0053.401] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x634) returned 0x3c [0053.657] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0053.657] GetProcAddress (hModule=0x77940000, lpProcName="SetThreadUILanguage") returned 0x77956d40 [0053.657] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0053.657] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0053.657] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1cf868 | out: phkResult=0x1cf868*=0x0) returned 0x2 [0053.658] VirtualQuery (in: lpAddress=0x1cf850, lpBuffer=0x1cf7d0, dwLength=0x30 | out: lpBuffer=0x1cf7d0*(BaseAddress=0x1cf000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0053.658] VirtualQuery (in: lpAddress=0xd0000, lpBuffer=0x1cf7d0, dwLength=0x30 | out: lpBuffer=0x1cf7d0*(BaseAddress=0xd0000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0053.658] VirtualQuery (in: lpAddress=0xd1000, lpBuffer=0x1cf7d0, dwLength=0x30 | out: lpBuffer=0x1cf7d0*(BaseAddress=0xd1000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0053.658] VirtualQuery (in: lpAddress=0xd4000, lpBuffer=0x1cf7d0, dwLength=0x30 | out: lpBuffer=0x1cf7d0*(BaseAddress=0xd4000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0053.658] VirtualQuery (in: lpAddress=0x1d0000, lpBuffer=0x1cf7d0, dwLength=0x30 | out: lpBuffer=0x1cf7d0*(BaseAddress=0x1d0000, AllocationBase=0x1d0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xe000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0053.658] GetConsoleOutputCP () returned 0x1b5 [0053.658] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f1bfe0 | out: lpCPInfo=0x49f1bfe0) returned 1 [0053.658] SetConsoleCtrlHandler (HandlerRoutine=0x49f03184, Add=1) returned 1 [0053.659] _get_osfhandle (_FileHandle=1) returned 0x114 [0053.659] SetConsoleMode (hConsoleHandle=0x114, dwMode=0x0) returned 0 [0053.659] _get_osfhandle (_FileHandle=1) returned 0x114 [0053.659] GetConsoleMode (in: hConsoleHandle=0x114, lpMode=0x49f0e194 | out: lpMode=0x49f0e194) returned 0 [0053.659] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.659] GetConsoleMode (in: hConsoleHandle=0x108, lpMode=0x49f0e198 | out: lpMode=0x49f0e198) returned 0 [0053.659] GetEnvironmentStringsW () returned 0x2f8a60* [0053.660] GetProcessHeap () returned 0x2e0000 [0053.660] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xa7c) returned 0x2f94f0 [0053.660] FreeEnvironmentStringsW (penv=0x2f8a60) returned 1 [0053.660] GetProcessHeap () returned 0x2e0000 [0053.660] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x8) returned 0x2f88e0 [0053.660] GetEnvironmentStringsW () returned 0x2f8a60* [0053.660] GetProcessHeap () returned 0x2e0000 [0053.660] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xa7c) returned 0x2f9f80 [0053.660] FreeEnvironmentStringsW (penv=0x2f8a60) returned 1 [0053.660] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ce728 | out: phkResult=0x1ce728*=0x44) returned 0x0 [0053.660] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ce720, lpData=0x1ce740, lpcbData=0x1ce724*=0x1000 | out: lpType=0x1ce720*=0x0, lpData=0x1ce740*=0x18, lpcbData=0x1ce724*=0x1000) returned 0x2 [0053.660] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ce720, lpData=0x1ce740, lpcbData=0x1ce724*=0x1000 | out: lpType=0x1ce720*=0x4, lpData=0x1ce740*=0x1, lpcbData=0x1ce724*=0x4) returned 0x0 [0053.661] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ce720, lpData=0x1ce740, lpcbData=0x1ce724*=0x1000 | out: lpType=0x1ce720*=0x0, lpData=0x1ce740*=0x1, lpcbData=0x1ce724*=0x1000) returned 0x2 [0053.661] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ce720, lpData=0x1ce740, lpcbData=0x1ce724*=0x1000 | out: lpType=0x1ce720*=0x4, lpData=0x1ce740*=0x0, lpcbData=0x1ce724*=0x4) returned 0x0 [0053.661] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ce720, lpData=0x1ce740, lpcbData=0x1ce724*=0x1000 | out: lpType=0x1ce720*=0x4, lpData=0x1ce740*=0x40, lpcbData=0x1ce724*=0x4) returned 0x0 [0053.661] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ce720, lpData=0x1ce740, lpcbData=0x1ce724*=0x1000 | out: lpType=0x1ce720*=0x4, lpData=0x1ce740*=0x40, lpcbData=0x1ce724*=0x4) returned 0x0 [0053.661] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ce720, lpData=0x1ce740, lpcbData=0x1ce724*=0x1000 | out: lpType=0x1ce720*=0x0, lpData=0x1ce740*=0x40, lpcbData=0x1ce724*=0x1000) returned 0x2 [0053.661] RegCloseKey (hKey=0x44) returned 0x0 [0053.661] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ce728 | out: phkResult=0x1ce728*=0x44) returned 0x0 [0053.661] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ce720, lpData=0x1ce740, lpcbData=0x1ce724*=0x1000 | out: lpType=0x1ce720*=0x0, lpData=0x1ce740*=0x40, lpcbData=0x1ce724*=0x1000) returned 0x2 [0053.661] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ce720, lpData=0x1ce740, lpcbData=0x1ce724*=0x1000 | out: lpType=0x1ce720*=0x4, lpData=0x1ce740*=0x1, lpcbData=0x1ce724*=0x4) returned 0x0 [0053.661] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ce720, lpData=0x1ce740, lpcbData=0x1ce724*=0x1000 | out: lpType=0x1ce720*=0x0, lpData=0x1ce740*=0x1, lpcbData=0x1ce724*=0x1000) returned 0x2 [0053.661] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ce720, lpData=0x1ce740, lpcbData=0x1ce724*=0x1000 | out: lpType=0x1ce720*=0x4, lpData=0x1ce740*=0x0, lpcbData=0x1ce724*=0x4) returned 0x0 [0053.661] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ce720, lpData=0x1ce740, lpcbData=0x1ce724*=0x1000 | out: lpType=0x1ce720*=0x4, lpData=0x1ce740*=0x9, lpcbData=0x1ce724*=0x4) returned 0x0 [0053.661] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ce720, lpData=0x1ce740, lpcbData=0x1ce724*=0x1000 | out: lpType=0x1ce720*=0x4, lpData=0x1ce740*=0x9, lpcbData=0x1ce724*=0x4) returned 0x0 [0053.661] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ce720, lpData=0x1ce740, lpcbData=0x1ce724*=0x1000 | out: lpType=0x1ce720*=0x0, lpData=0x1ce740*=0x9, lpcbData=0x1ce724*=0x1000) returned 0x2 [0053.661] RegCloseKey (hKey=0x44) returned 0x0 [0053.662] time (in: timer=0x0 | out: timer=0x0) returned 0x5f3d2ec3 [0053.662] srand (_Seed=0x5f3d2ec3) [0053.662] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0053.662] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0053.662] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f1c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0053.662] GetProcessHeap () returned 0x2e0000 [0053.662] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x218) returned 0x2faa10 [0053.662] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2faa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0053.662] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f0f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0053.663] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f0f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0053.663] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f0f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0053.663] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0053.663] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0053.663] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0053.663] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0053.663] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0053.663] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0053.663] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0053.663] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0053.663] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0053.663] GetProcessHeap () returned 0x2e0000 [0053.663] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f94f0 | out: hHeap=0x2e0000) returned 1 [0053.663] GetEnvironmentStringsW () returned 0x2f8a60* [0053.663] GetProcessHeap () returned 0x2e0000 [0053.663] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xa94) returned 0x2fac30 [0053.663] FreeEnvironmentStringsW (penv=0x2f8a60) returned 1 [0053.664] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49f0f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0053.664] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49f0f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0053.664] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0053.664] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0053.664] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0053.664] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0053.664] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0053.664] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0053.664] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0053.664] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0053.664] GetProcessHeap () returned 0x2e0000 [0053.664] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x5c) returned 0x2fb6d0 [0053.664] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1cf530 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0053.664] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x1cf530, lpFilePart=0x1cf510 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1cf510*="Desktop") returned 0x25 [0053.664] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0053.664] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1cf240 | out: lpFindFileData=0x1cf240*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x2fb740 [0053.665] FindClose (in: hFindFile=0x2fb740 | out: hFindFile=0x2fb740) returned 1 [0053.665] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x1cf240 | out: lpFindFileData=0x1cf240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x2fb740 [0053.665] FindClose (in: hFindFile=0x2fb740 | out: hFindFile=0x2fb740) returned 1 [0053.665] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0053.665] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x1cf240 | out: lpFindFileData=0x1cf240*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5244860, ftLastAccessTime.dwHighDateTime=0x1d67630, ftLastWriteTime.dwLowDateTime=0x5244860, ftLastWriteTime.dwHighDateTime=0x1d67630, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x2fb740 [0053.665] FindClose (in: hFindFile=0x2fb740 | out: hFindFile=0x2fb740) returned 1 [0053.666] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0053.666] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0053.666] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0053.666] GetProcessHeap () returned 0x2e0000 [0053.666] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fac30 | out: hHeap=0x2e0000) returned 1 [0053.666] GetEnvironmentStringsW () returned 0x2fb740* [0053.666] GetProcessHeap () returned 0x2e0000 [0053.666] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xae8) returned 0x2fc230 [0053.666] FreeEnvironmentStringsW (penv=0x2fb740) returned 1 [0053.666] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f1c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0053.666] GetProcessHeap () returned 0x2e0000 [0053.666] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fb6d0 | out: hHeap=0x2e0000) returned 1 [0053.666] GetProcessHeap () returned 0x2e0000 [0053.666] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x4016) returned 0x2fcd20 [0053.667] GetProcessHeap () returned 0x2e0000 [0053.667] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcd20 | out: hHeap=0x2e0000) returned 1 [0053.667] GetConsoleOutputCP () returned 0x1b5 [0053.667] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f1bfe0 | out: lpCPInfo=0x49f1bfe0) returned 1 [0053.667] GetUserDefaultLCID () returned 0x409 [0053.668] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49f17b50, cchData=8 | out: lpLCData=":") returned 2 [0053.668] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1cf640, cchData=128 | out: lpLCData="0") returned 2 [0053.668] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1cf640, cchData=128 | out: lpLCData="0") returned 2 [0053.668] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1cf640, cchData=128 | out: lpLCData="1") returned 2 [0053.668] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49f2a740, cchData=8 | out: lpLCData="/") returned 2 [0053.668] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49f2a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0053.668] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49f2a460, cchData=32 | out: lpLCData="Tue") returned 4 [0053.668] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49f2a420, cchData=32 | out: lpLCData="Wed") returned 4 [0053.668] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49f2a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0053.668] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49f2a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0053.669] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49f2a360, cchData=32 | out: lpLCData="Sat") returned 4 [0053.669] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49f2a700, cchData=32 | out: lpLCData="Sun") returned 4 [0053.669] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49f17b40, cchData=8 | out: lpLCData=".") returned 2 [0053.669] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49f2a4e0, cchData=8 | out: lpLCData=",") returned 2 [0053.669] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0053.670] GetProcessHeap () returned 0x2e0000 [0053.670] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x20c) returned 0x2f95c0 [0053.670] GetConsoleTitleW (in: lpConsoleTitle=0x2f95c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0053.670] _get_osfhandle (_FileHandle=1) returned 0x114 [0053.670] GetFileType (hFile=0x114) returned 0x3 [0053.670] BrandingFormatString () returned 0x2f97e0 [0053.678] GetVersion () returned 0x1db10106 [0053.678] _vsnwprintf (in: _Buffer=0x1cf7b0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x1cf748 | out: _Buffer="6.1.7601") returned 8 [0053.678] _get_osfhandle (_FileHandle=1) returned 0x114 [0053.678] GetFileType (hFile=0x114) returned 0x3 [0053.678] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x49f26340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0053.678] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x49f26340, nSize=0x2000, Arguments=0x1cf750 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0053.678] _get_osfhandle (_FileHandle=1) returned 0x114 [0053.678] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x49f1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0053.678] WriteFile (in: hFile=0x114, lpBuffer=0x49f1c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x1cf6d8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesWritten=0x1cf6d8*=0x24, lpOverlapped=0x0) returned 1 [0053.679] _vsnwprintf (in: _Buffer=0x49f26340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1cf778 | out: _Buffer="\r\n") returned 2 [0053.679] _get_osfhandle (_FileHandle=1) returned 0x114 [0053.679] GetFileType (hFile=0x114) returned 0x3 [0053.679] _get_osfhandle (_FileHandle=1) returned 0x114 [0053.679] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0053.679] WriteFile (in: hFile=0x114, lpBuffer=0x49f1c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1cf748, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesWritten=0x1cf748*=0x2, lpOverlapped=0x0) returned 1 [0053.679] _vsnwprintf (in: _Buffer=0x49f26340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x1cf778 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0053.679] _get_osfhandle (_FileHandle=1) returned 0x114 [0053.679] GetFileType (hFile=0x114) returned 0x3 [0053.679] _get_osfhandle (_FileHandle=1) returned 0x114 [0053.679] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x49f1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0053.679] WriteFile (in: hFile=0x114, lpBuffer=0x49f1c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x1cf748, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesWritten=0x1cf748*=0x3f, lpOverlapped=0x0) returned 1 [0053.679] _vsnwprintf (in: _Buffer=0x49f26340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1cf778 | out: _Buffer="\r\n") returned 2 [0053.679] _get_osfhandle (_FileHandle=1) returned 0x114 [0053.679] GetFileType (hFile=0x114) returned 0x3 [0053.679] _get_osfhandle (_FileHandle=1) returned 0x114 [0053.679] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0053.679] WriteFile (in: hFile=0x114, lpBuffer=0x49f1c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1cf748, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesWritten=0x1cf748*=0x2, lpOverlapped=0x0) returned 1 [0053.680] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0053.680] GetProcAddress (hModule=0x77940000, lpProcName="CopyFileExW") returned 0x779523d0 [0053.680] GetProcAddress (hModule=0x77940000, lpProcName="IsDebuggerPresent") returned 0x77948290 [0053.680] GetProcAddress (hModule=0x77940000, lpProcName="SetConsoleInputExeNameW") returned 0x779517e0 [0053.681] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.681] GetFileType (hFile=0x108) returned 0x3 [0053.681] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0053.681] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x1cf5a0 | out: TokenHandle=0x1cf5a0*=0x0) returned 0xc000007c [0053.681] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x1cf5a0 | out: TokenHandle=0x1cf5a0*=0x50) returned 0x0 [0053.681] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x1cf5b0, TokenInformationLength=0x4, ReturnLength=0x1cf5b8 | out: TokenInformation=0x1cf5b0, ReturnLength=0x1cf5b8) returned 0x0 [0053.681] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x1cf5b8, TokenInformationLength=0x4, ReturnLength=0x1cf5b0 | out: TokenInformation=0x1cf5b8, ReturnLength=0x1cf5b0) returned 0x0 [0053.681] NtClose (Handle=0x50) returned 0x0 [0053.681] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x1cf580, nSize=0x0, Arguments=0x1cf588 | out: lpBuffer="韠/") returned 0xf [0053.681] GetProcessHeap () returned 0x2e0000 [0053.681] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x218) returned 0x2e1ab0 [0053.681] GetConsoleTitleW (in: lpConsoleTitle=0x1cf5d0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0053.937] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0053.937] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0053.938] GetProcessHeap () returned 0x2e0000 [0053.938] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2e1ab0 | out: hHeap=0x2e0000) returned 1 [0053.938] LocalFree (hMem=0x2f97e0) returned 0x0 [0053.939] GetProcessHeap () returned 0x2e0000 [0053.939] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2faa10 | out: hHeap=0x2e0000) returned 1 [0053.939] _vsnwprintf (in: _Buffer=0x49f26340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1cf2b8 | out: _Buffer="\r\n") returned 2 [0053.939] _get_osfhandle (_FileHandle=1) returned 0x114 [0053.939] GetFileType (hFile=0x114) returned 0x3 [0053.939] _get_osfhandle (_FileHandle=1) returned 0x114 [0053.939] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0053.939] WriteFile (in: hFile=0x114, lpBuffer=0x49f1c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1cf288, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesWritten=0x1cf288*=0x2, lpOverlapped=0x0) returned 1 [0053.940] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f0f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0053.940] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f1c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0053.940] _vsnwprintf (in: _Buffer=0x49f0eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1cf2c8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0053.940] _vsnwprintf (in: _Buffer=0x49f0ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1cf2c8 | out: _Buffer=">") returned 1 [0053.940] _get_osfhandle (_FileHandle=1) returned 0x114 [0053.940] GetFileType (hFile=0x114) returned 0x3 [0053.940] _get_osfhandle (_FileHandle=1) returned 0x114 [0053.940] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0053.940] WriteFile (in: hFile=0x114, lpBuffer=0x49f1c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1cf2b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesWritten=0x1cf2b8*=0x26, lpOverlapped=0x0) returned 1 [0053.940] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.940] GetFileType (hFile=0x108) returned 0x3 [0053.940] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.940] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.941] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.941] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e320, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0053.941] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.941] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.941] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.941] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e322, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0053.941] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.941] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.941] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.941] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e324, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0053.941] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.941] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.941] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.942] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e326, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0053.942] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.942] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.942] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.942] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e328, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0053.942] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.942] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.942] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.942] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e32a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0053.942] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.942] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.942] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.942] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e32c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0053.942] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.942] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.942] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.943] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e32e, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0053.943] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.943] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.943] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.943] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e330, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0053.943] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.943] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.943] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.943] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e332, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0053.943] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.943] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.943] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.943] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e334, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0053.944] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.944] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.944] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.944] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e336, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0053.944] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.944] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.944] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.944] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e338, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0053.944] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.944] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.944] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.944] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e33a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0053.944] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.945] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.945] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.945] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e33c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0053.945] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.945] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.945] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.945] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e33e, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0053.945] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.945] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.945] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.945] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e340, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0053.945] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.945] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.945] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.945] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e342, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0053.945] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.946] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.946] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.946] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e344, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0053.946] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.946] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.946] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.946] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e346, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0053.946] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.946] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.946] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.946] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e348, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0053.946] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.946] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.946] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.946] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e34a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0053.946] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.946] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.947] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.947] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e34c, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0053.947] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.947] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.947] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.947] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e34e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0053.947] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.947] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.947] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.947] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e350, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0053.947] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.947] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.947] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.947] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e352, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0053.947] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.947] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.947] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.948] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e354, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0053.948] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.948] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.948] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.948] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e356, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0053.948] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.948] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.948] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.948] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e358, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0053.948] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.948] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.948] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.948] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e35a, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0053.948] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.948] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.948] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.948] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e35c, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0053.948] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.949] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.949] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.949] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e35e, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0053.949] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.949] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.949] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.949] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e360, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0053.949] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.949] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.949] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.949] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e362, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0053.949] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.949] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.949] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.949] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e364, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0053.949] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.949] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.950] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.950] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e366, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0053.950] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.950] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.950] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.950] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e368, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0053.950] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.950] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.950] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.950] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e36a, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0053.950] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.950] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.950] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.950] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e36c, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0053.950] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.950] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.951] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.951] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e36e, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0053.951] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.951] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.951] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.951] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e370, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0053.951] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.951] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.951] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.951] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e372, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0053.951] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.951] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.951] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.951] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e374, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0053.951] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.951] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.952] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.952] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e376, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0053.952] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.952] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.952] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.952] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e378, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0053.952] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.952] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.952] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.952] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e37a, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0053.952] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.952] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.952] ReadFile (in: hFile=0x108, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf5b8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x1cf5b8*=0x1, lpOverlapped=0x0) returned 1 [0053.952] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e37c, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0053.954] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.954] GetFileType (hFile=0x108) returned 0x3 [0053.954] _get_osfhandle (_FileHandle=0) returned 0x108 [0053.954] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.954] _get_osfhandle (_FileHandle=1) returned 0x114 [0053.954] GetFileType (hFile=0x114) returned 0x3 [0053.954] _get_osfhandle (_FileHandle=1) returned 0x114 [0053.955] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="netsh advfirewall set currentprofile state off\n", cchWideChar=-1, lpMultiByteStr=0x49f1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh advfirewall set currentprofile state off\n", lpUsedDefaultChar=0x0) returned 48 [0053.955] WriteFile (in: hFile=0x114, lpBuffer=0x49f1c320*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x1cf598, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesWritten=0x1cf598*=0x2f, lpOverlapped=0x0) returned 1 [0053.955] GetProcessHeap () returned 0x2e0000 [0053.955] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x4012) returned 0x2fcd20 [0053.955] GetProcessHeap () returned 0x2e0000 [0053.955] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fcd20 | out: hHeap=0x2e0000) returned 1 [0053.955] _wcsicmp (_String1="netsh", _String2=")") returned 69 [0053.955] _wcsicmp (_String1="FOR", _String2="netsh") returned -8 [0053.956] _wcsicmp (_String1="FOR/?", _String2="netsh") returned -8 [0053.956] _wcsicmp (_String1="IF", _String2="netsh") returned -5 [0053.956] _wcsicmp (_String1="IF/?", _String2="netsh") returned -5 [0053.956] _wcsicmp (_String1="REM", _String2="netsh") returned 4 [0053.956] _wcsicmp (_String1="REM/?", _String2="netsh") returned 4 [0053.956] GetProcessHeap () returned 0x2e0000 [0053.956] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xb0) returned 0x2f97e0 [0053.956] GetProcessHeap () returned 0x2e0000 [0053.956] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x1c) returned 0x2f4610 [0053.957] GetProcessHeap () returned 0x2e0000 [0053.957] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x64) returned 0x2f98a0 [0053.958] GetConsoleOutputCP () returned 0x1b5 [0053.958] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f1bfe0 | out: lpCPInfo=0x49f1bfe0) returned 1 [0053.958] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0053.959] GetConsoleTitleW (in: lpConsoleTitle=0x1cf550, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0053.959] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0053.959] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0053.959] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0053.959] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0053.959] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0053.959] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0053.959] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0053.959] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0053.960] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0053.960] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0053.960] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0053.960] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0053.960] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0053.960] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0053.960] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0053.960] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0053.960] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0053.960] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0053.960] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0053.960] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0053.960] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0053.960] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0053.960] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0053.960] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0053.960] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0053.960] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0053.960] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0053.960] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0053.960] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0053.960] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0053.960] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0053.960] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0053.961] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0053.961] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0053.961] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0053.961] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0053.961] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0053.961] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0053.961] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0053.961] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0053.961] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0053.961] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0053.961] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0053.961] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0053.961] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0053.961] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0053.961] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0053.961] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0053.961] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0053.961] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0053.962] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0053.962] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0053.962] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0053.962] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0053.962] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0053.962] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0053.962] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0053.962] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0053.962] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0053.962] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0053.962] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0053.962] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0053.962] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0053.962] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0053.962] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0053.962] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0053.962] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0053.963] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0053.963] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0053.963] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0053.963] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0053.963] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0053.963] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0053.963] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0053.963] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0053.963] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0053.963] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0053.963] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0053.963] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0053.963] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0053.963] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0053.963] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0053.963] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0053.963] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0053.964] _wcsicmp (_String1="netsh", _String2="FOR") returned 8 [0053.964] _wcsicmp (_String1="netsh", _String2="IF") returned 5 [0053.964] _wcsicmp (_String1="netsh", _String2="REM") returned -4 [0053.964] GetProcessHeap () returned 0x2e0000 [0053.964] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x218) returned 0x2e1ab0 [0053.964] GetProcessHeap () returned 0x2e0000 [0053.964] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x70) returned 0x2e1cd0 [0053.964] _wcsnicmp (_String1="nets", _String2="cmd ", _MaxCount=0x4) returned 11 [0053.965] GetProcessHeap () returned 0x2e0000 [0053.965] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x420) returned 0x2f9a80 [0053.965] SetErrorMode (uMode=0x0) returned 0x0 [0053.965] SetErrorMode (uMode=0x1) returned 0x0 [0053.965] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2f9a90, lpFilePart=0x1cede0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1cede0*="Desktop") returned 0x25 [0053.965] SetErrorMode (uMode=0x0) returned 0x1 [0053.965] GetProcessHeap () returned 0x2e0000 [0053.965] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f9a80, Size=0x68) returned 0x2f9a80 [0053.965] GetProcessHeap () returned 0x2e0000 [0053.965] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f9a80) returned 0x68 [0053.966] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f0f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0053.966] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0053.966] GetProcessHeap () returned 0x2e0000 [0053.966] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x128) returned 0x2f5b70 [0053.966] GetProcessHeap () returned 0x2e0000 [0053.966] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x240) returned 0x2f9b00 [0053.974] GetProcessHeap () returned 0x2e0000 [0053.974] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f9b00, Size=0x12a) returned 0x2f9b00 [0053.974] GetProcessHeap () returned 0x2e0000 [0053.974] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f9b00) returned 0x12a [0053.974] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f0f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0053.974] GetProcessHeap () returned 0x2e0000 [0053.974] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xe8) returned 0x2f9c40 [0053.974] GetProcessHeap () returned 0x2e0000 [0053.974] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f9c40, Size=0x7e) returned 0x2f9c40 [0053.974] GetProcessHeap () returned 0x2e0000 [0053.974] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f9c40) returned 0x7e [0054.204] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0054.204] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x1ceb50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceb50) returned 0xffffffffffffffff [0054.204] GetLastError () returned 0x2 [0054.204] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\netsh", fInfoLevelId=0x1, lpFindFileData=0x1ceb50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceb50) returned 0xffffffffffffffff [0054.205] GetLastError () returned 0x2 [0054.205] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0054.205] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x1ceb50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceb50) returned 0x2e1d50 [0054.205] GetProcessHeap () returned 0x2e0000 [0054.205] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x0, Size=0x28) returned 0x2f4640 [0054.205] FindClose (in: hFindFile=0x2e1d50 | out: hFindFile=0x2e1d50) returned 1 [0054.205] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.COM", fInfoLevelId=0x1, lpFindFileData=0x1ceb50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceb50) returned 0xffffffffffffffff [0054.206] GetLastError () returned 0x2 [0054.206] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.EXE", fInfoLevelId=0x1, lpFindFileData=0x1ceb50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ceb50) returned 0x2e1d50 [0054.206] GetProcessHeap () returned 0x2e0000 [0054.206] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f4640, Size=0x8) returned 0x2f8900 [0054.206] FindClose (in: hFindFile=0x2e1d50 | out: hFindFile=0x2e1d50) returned 1 [0054.206] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0054.206] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0054.206] GetConsoleTitleW (in: lpConsoleTitle=0x1cf0a0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0054.207] GetProcessHeap () returned 0x2e0000 [0054.207] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x21c) returned 0x2f9cd0 [0054.207] GetConsoleTitleW (in: lpConsoleTitle=0x2f9ce0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0054.207] GetProcessHeap () returned 0x2e0000 [0054.207] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x0, Ptr=0x2f9cd0, Size=0xd6) returned 0x2f9cd0 [0054.207] GetProcessHeap () returned 0x2e0000 [0054.207] RtlSizeHeap (HeapHandle=0x2e0000, Flags=0x0, MemoryPointer=0x2f9cd0) returned 0xd6 [0054.207] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - netsh advfirewall set currentprofile state off") returned 1 [0054.208] GetProcessHeap () returned 0x2e0000 [0054.208] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f9cd0 | out: hHeap=0x2e0000) returned 1 [0054.208] InitializeProcThreadAttributeList (in: lpAttributeList=0x1cee58, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1cee18 | out: lpAttributeList=0x1cee58, lpSize=0x1cee18) returned 1 [0054.208] UpdateProcThreadAttribute (in: lpAttributeList=0x1cee58, dwFlags=0x0, Attribute=0x60001, lpValue=0x1cee08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1cee58, lpPreviousValue=0x0) returned 1 [0054.208] GetStartupInfoW (in: lpStartupInfo=0x1cef70 | out: lpStartupInfo=0x1cef70*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x108, hStdOutput=0x114, hStdError=0x114)) [0054.209] GetProcessHeap () returned 0x2e0000 [0054.209] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x20) returned 0x2f4640 [0054.209] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0054.209] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0054.209] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0054.209] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0054.209] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0054.209] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0054.209] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0054.209] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0054.209] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0054.209] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0054.209] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0054.209] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0054.209] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0054.209] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0054.209] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0054.209] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0054.209] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0054.209] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0054.209] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0054.209] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0054.210] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0054.210] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0054.210] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0054.210] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0054.210] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0054.210] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0054.210] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0054.210] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0054.210] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0054.210] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0054.210] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0054.210] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0054.210] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0054.210] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0054.210] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0054.210] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0054.210] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0054.210] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0054.210] GetProcessHeap () returned 0x2e0000 [0054.210] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2f4640 | out: hHeap=0x2e0000) returned 1 [0054.210] GetProcessHeap () returned 0x2e0000 [0054.210] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x12) returned 0x2f5ca0 [0054.210] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\netsh.exe", lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1cee90*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="netsh advfirewall set currentprofile state off", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1cee40 | out: lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessInformation=0x1cee40*(hProcess=0x54, hThread=0x50, dwProcessId=0x864, dwThreadId=0x874)) returned 1 [0058.111] CloseHandle (hObject=0x50) returned 1 [0058.111] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0058.111] GetProcessHeap () returned 0x2e0000 [0058.111] HeapFree (in: hHeap=0x2e0000, dwFlags=0x0, lpMem=0x2fc230 | out: hHeap=0x2e0000) returned 1 [0058.111] GetEnvironmentStringsW () returned 0x2faa10* [0058.111] GetProcessHeap () returned 0x2e0000 [0058.111] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xae8) returned 0x2fb500 [0058.112] FreeEnvironmentStringsW (penv=0x2faa10) returned 1 [0058.112] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77a60000 [0058.112] GetProcAddress (hModule=0x77a60000, lpProcName="NtQueryInformationProcess") returned 0x77ab14a0 [0058.112] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1ce748, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1ce748, ReturnLength=0x0) returned 0x0 [0058.112] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdc000, lpBuffer=0x1ce780, nSize=0x380, lpNumberOfBytesRead=0x1ce740 | out: lpBuffer=0x1ce780*, lpNumberOfBytesRead=0x1ce740*=0x380) returned 1 [0058.113] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) Process: id = "4" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x3698d000" os_pid = "0x318" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x3a4" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 21 os_tid = 0x6c0 [0053.164] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2af950 | out: lpSystemTimeAsFileTime=0x2af950*(dwLowDateTime=0x11215fe0, dwHighDateTime=0x1d67630)) [0053.165] GetCurrentProcessId () returned 0x318 [0053.165] GetCurrentThreadId () returned 0x6c0 [0053.165] GetTickCount () returned 0x1146835 [0053.165] QueryPerformanceCounter (in: lpPerformanceCount=0x2af958 | out: lpPerformanceCount=0x2af958*=17316797773) returned 1 [0053.175] GetModuleHandleW (lpModuleName=0x0) returned 0x49ee0000 [0053.176] __set_app_type (_Type=0x1) [0053.176] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49f07810) returned 0x0 [0053.177] __getmainargs (in: _Argc=0x49f2a608, _Argv=0x49f2a618, _Env=0x49f2a610, _DoWildCard=0, _StartInfo=0x49f0e0f4 | out: _Argc=0x49f2a608, _Argv=0x49f2a618, _Env=0x49f2a610) returned 0 [0053.177] GetCurrentThreadId () returned 0x6c0 [0053.177] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x6c0) returned 0x3c [0053.402] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0053.402] GetProcAddress (hModule=0x77940000, lpProcName="SetThreadUILanguage") returned 0x77956d40 [0053.402] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0053.403] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0053.403] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2af8e8 | out: phkResult=0x2af8e8*=0x0) returned 0x2 [0053.404] VirtualQuery (in: lpAddress=0x2af8d0, lpBuffer=0x2af850, dwLength=0x30 | out: lpBuffer=0x2af850*(BaseAddress=0x2af000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0053.404] VirtualQuery (in: lpAddress=0x1b0000, lpBuffer=0x2af850, dwLength=0x30 | out: lpBuffer=0x2af850*(BaseAddress=0x1b0000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0053.404] VirtualQuery (in: lpAddress=0x1b1000, lpBuffer=0x2af850, dwLength=0x30 | out: lpBuffer=0x2af850*(BaseAddress=0x1b1000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0053.404] VirtualQuery (in: lpAddress=0x1b4000, lpBuffer=0x2af850, dwLength=0x30 | out: lpBuffer=0x2af850*(BaseAddress=0x1b4000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0053.404] VirtualQuery (in: lpAddress=0x2b0000, lpBuffer=0x2af850, dwLength=0x30 | out: lpBuffer=0x2af850*(BaseAddress=0x2b0000, AllocationBase=0x2b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xe000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0053.404] GetConsoleOutputCP () returned 0x1b5 [0053.404] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f1bfe0 | out: lpCPInfo=0x49f1bfe0) returned 1 [0053.405] SetConsoleCtrlHandler (HandlerRoutine=0x49f03184, Add=1) returned 1 [0053.405] _get_osfhandle (_FileHandle=1) returned 0x104 [0053.405] SetConsoleMode (hConsoleHandle=0x104, dwMode=0x0) returned 0 [0053.405] _get_osfhandle (_FileHandle=1) returned 0x104 [0053.405] GetConsoleMode (in: hConsoleHandle=0x104, lpMode=0x49f0e194 | out: lpMode=0x49f0e194) returned 0 [0053.406] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.406] GetConsoleMode (in: hConsoleHandle=0xf8, lpMode=0x49f0e198 | out: lpMode=0x49f0e198) returned 0 [0053.406] GetEnvironmentStringsW () returned 0x418a60* [0053.406] GetProcessHeap () returned 0x400000 [0053.406] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xa7c) returned 0x4194f0 [0053.406] FreeEnvironmentStringsW (penv=0x418a60) returned 1 [0053.406] GetProcessHeap () returned 0x400000 [0053.406] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x8) returned 0x4188e0 [0053.406] GetEnvironmentStringsW () returned 0x418a60* [0053.406] GetProcessHeap () returned 0x400000 [0053.407] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xa7c) returned 0x419f80 [0053.407] FreeEnvironmentStringsW (penv=0x418a60) returned 1 [0053.407] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2ae7a8 | out: phkResult=0x2ae7a8*=0x44) returned 0x0 [0053.407] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2ae7a0, lpData=0x2ae7c0, lpcbData=0x2ae7a4*=0x1000 | out: lpType=0x2ae7a0*=0x0, lpData=0x2ae7c0*=0x18, lpcbData=0x2ae7a4*=0x1000) returned 0x2 [0053.407] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2ae7a0, lpData=0x2ae7c0, lpcbData=0x2ae7a4*=0x1000 | out: lpType=0x2ae7a0*=0x4, lpData=0x2ae7c0*=0x1, lpcbData=0x2ae7a4*=0x4) returned 0x0 [0053.408] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2ae7a0, lpData=0x2ae7c0, lpcbData=0x2ae7a4*=0x1000 | out: lpType=0x2ae7a0*=0x0, lpData=0x2ae7c0*=0x1, lpcbData=0x2ae7a4*=0x1000) returned 0x2 [0053.408] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2ae7a0, lpData=0x2ae7c0, lpcbData=0x2ae7a4*=0x1000 | out: lpType=0x2ae7a0*=0x4, lpData=0x2ae7c0*=0x0, lpcbData=0x2ae7a4*=0x4) returned 0x0 [0053.408] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2ae7a0, lpData=0x2ae7c0, lpcbData=0x2ae7a4*=0x1000 | out: lpType=0x2ae7a0*=0x4, lpData=0x2ae7c0*=0x40, lpcbData=0x2ae7a4*=0x4) returned 0x0 [0053.408] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2ae7a0, lpData=0x2ae7c0, lpcbData=0x2ae7a4*=0x1000 | out: lpType=0x2ae7a0*=0x4, lpData=0x2ae7c0*=0x40, lpcbData=0x2ae7a4*=0x4) returned 0x0 [0053.408] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2ae7a0, lpData=0x2ae7c0, lpcbData=0x2ae7a4*=0x1000 | out: lpType=0x2ae7a0*=0x0, lpData=0x2ae7c0*=0x40, lpcbData=0x2ae7a4*=0x1000) returned 0x2 [0053.408] RegCloseKey (hKey=0x44) returned 0x0 [0053.408] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2ae7a8 | out: phkResult=0x2ae7a8*=0x44) returned 0x0 [0053.408] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2ae7a0, lpData=0x2ae7c0, lpcbData=0x2ae7a4*=0x1000 | out: lpType=0x2ae7a0*=0x0, lpData=0x2ae7c0*=0x40, lpcbData=0x2ae7a4*=0x1000) returned 0x2 [0053.408] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2ae7a0, lpData=0x2ae7c0, lpcbData=0x2ae7a4*=0x1000 | out: lpType=0x2ae7a0*=0x4, lpData=0x2ae7c0*=0x1, lpcbData=0x2ae7a4*=0x4) returned 0x0 [0053.408] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2ae7a0, lpData=0x2ae7c0, lpcbData=0x2ae7a4*=0x1000 | out: lpType=0x2ae7a0*=0x0, lpData=0x2ae7c0*=0x1, lpcbData=0x2ae7a4*=0x1000) returned 0x2 [0053.408] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2ae7a0, lpData=0x2ae7c0, lpcbData=0x2ae7a4*=0x1000 | out: lpType=0x2ae7a0*=0x4, lpData=0x2ae7c0*=0x0, lpcbData=0x2ae7a4*=0x4) returned 0x0 [0053.409] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2ae7a0, lpData=0x2ae7c0, lpcbData=0x2ae7a4*=0x1000 | out: lpType=0x2ae7a0*=0x4, lpData=0x2ae7c0*=0x9, lpcbData=0x2ae7a4*=0x4) returned 0x0 [0053.409] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2ae7a0, lpData=0x2ae7c0, lpcbData=0x2ae7a4*=0x1000 | out: lpType=0x2ae7a0*=0x4, lpData=0x2ae7c0*=0x9, lpcbData=0x2ae7a4*=0x4) returned 0x0 [0053.409] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2ae7a0, lpData=0x2ae7c0, lpcbData=0x2ae7a4*=0x1000 | out: lpType=0x2ae7a0*=0x0, lpData=0x2ae7c0*=0x9, lpcbData=0x2ae7a4*=0x1000) returned 0x2 [0053.409] RegCloseKey (hKey=0x44) returned 0x0 [0053.409] time (in: timer=0x0 | out: timer=0x0) returned 0x5f3d2ec3 [0053.409] srand (_Seed=0x5f3d2ec3) [0053.409] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0053.409] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0053.409] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f1c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0053.409] GetProcessHeap () returned 0x400000 [0053.410] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x218) returned 0x41aa10 [0053.410] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x41aa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0053.410] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f0f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0053.410] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f0f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0053.410] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f0f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0053.410] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0053.410] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0053.410] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0053.410] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0053.410] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0053.410] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0053.410] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0053.410] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0053.410] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0053.411] GetProcessHeap () returned 0x400000 [0053.411] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4194f0 | out: hHeap=0x400000) returned 1 [0053.411] GetEnvironmentStringsW () returned 0x418a60* [0053.411] GetProcessHeap () returned 0x400000 [0053.411] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xa94) returned 0x41ac30 [0053.411] FreeEnvironmentStringsW (penv=0x418a60) returned 1 [0053.411] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49f0f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0053.411] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49f0f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0053.411] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0053.411] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0053.411] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0053.411] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0053.411] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0053.411] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0053.412] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0053.412] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0053.412] GetProcessHeap () returned 0x400000 [0053.412] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x5c) returned 0x41b6d0 [0053.412] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x2af5b0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0053.412] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x2af5b0, lpFilePart=0x2af590 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2af590*="Desktop") returned 0x25 [0053.412] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0053.412] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x2af2c0 | out: lpFindFileData=0x2af2c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x41b740 [0053.413] FindClose (in: hFindFile=0x41b740 | out: hFindFile=0x41b740) returned 1 [0053.413] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x2af2c0 | out: lpFindFileData=0x2af2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x41b740 [0053.413] FindClose (in: hFindFile=0x41b740 | out: hFindFile=0x41b740) returned 1 [0053.413] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0053.413] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x2af2c0 | out: lpFindFileData=0x2af2c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5244860, ftLastAccessTime.dwHighDateTime=0x1d67630, ftLastWriteTime.dwLowDateTime=0x5244860, ftLastWriteTime.dwHighDateTime=0x1d67630, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x41b740 [0053.413] FindClose (in: hFindFile=0x41b740 | out: hFindFile=0x41b740) returned 1 [0053.414] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0053.414] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0053.414] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0053.414] GetProcessHeap () returned 0x400000 [0053.414] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41ac30 | out: hHeap=0x400000) returned 1 [0053.414] GetEnvironmentStringsW () returned 0x41b740* [0053.414] GetProcessHeap () returned 0x400000 [0053.414] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xae8) returned 0x41c230 [0053.414] FreeEnvironmentStringsW (penv=0x41b740) returned 1 [0053.414] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f1c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0053.414] GetProcessHeap () returned 0x400000 [0053.414] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41b6d0 | out: hHeap=0x400000) returned 1 [0053.415] GetProcessHeap () returned 0x400000 [0053.415] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x4016) returned 0x41cd20 [0053.415] GetProcessHeap () returned 0x400000 [0053.415] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41cd20 | out: hHeap=0x400000) returned 1 [0053.415] GetConsoleOutputCP () returned 0x1b5 [0053.415] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f1bfe0 | out: lpCPInfo=0x49f1bfe0) returned 1 [0053.415] GetUserDefaultLCID () returned 0x409 [0053.416] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49f17b50, cchData=8 | out: lpLCData=":") returned 2 [0053.416] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2af6c0, cchData=128 | out: lpLCData="0") returned 2 [0053.416] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2af6c0, cchData=128 | out: lpLCData="0") returned 2 [0053.417] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2af6c0, cchData=128 | out: lpLCData="1") returned 2 [0053.417] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49f2a740, cchData=8 | out: lpLCData="/") returned 2 [0053.417] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49f2a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0053.417] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49f2a460, cchData=32 | out: lpLCData="Tue") returned 4 [0053.417] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49f2a420, cchData=32 | out: lpLCData="Wed") returned 4 [0053.417] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49f2a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0053.417] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49f2a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0053.417] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49f2a360, cchData=32 | out: lpLCData="Sat") returned 4 [0053.417] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49f2a700, cchData=32 | out: lpLCData="Sun") returned 4 [0053.417] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49f17b40, cchData=8 | out: lpLCData=".") returned 2 [0053.417] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49f2a4e0, cchData=8 | out: lpLCData=",") returned 2 [0053.418] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0053.419] GetProcessHeap () returned 0x400000 [0053.419] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20c) returned 0x4195c0 [0053.419] GetConsoleTitleW (in: lpConsoleTitle=0x4195c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0053.419] _get_osfhandle (_FileHandle=1) returned 0x104 [0053.419] GetFileType (hFile=0x104) returned 0x3 [0053.420] BrandingFormatString () returned 0x4197e0 [0053.687] GetVersion () returned 0x1db10106 [0053.687] _vsnwprintf (in: _Buffer=0x2af830, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x2af7c8 | out: _Buffer="6.1.7601") returned 8 [0053.687] _get_osfhandle (_FileHandle=1) returned 0x104 [0053.687] GetFileType (hFile=0x104) returned 0x3 [0053.687] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x49f26340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0053.688] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x49f26340, nSize=0x2000, Arguments=0x2af7d0 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0053.688] _get_osfhandle (_FileHandle=1) returned 0x104 [0053.688] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x49f1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0053.688] WriteFile (in: hFile=0x104, lpBuffer=0x49f1c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x2af758, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesWritten=0x2af758*=0x24, lpOverlapped=0x0) returned 1 [0053.688] _vsnwprintf (in: _Buffer=0x49f26340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2af7f8 | out: _Buffer="\r\n") returned 2 [0053.688] _get_osfhandle (_FileHandle=1) returned 0x104 [0053.688] GetFileType (hFile=0x104) returned 0x3 [0053.688] _get_osfhandle (_FileHandle=1) returned 0x104 [0053.688] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0053.688] WriteFile (in: hFile=0x104, lpBuffer=0x49f1c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2af7c8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesWritten=0x2af7c8*=0x2, lpOverlapped=0x0) returned 1 [0053.688] _vsnwprintf (in: _Buffer=0x49f26340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x2af7f8 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0053.688] _get_osfhandle (_FileHandle=1) returned 0x104 [0053.688] GetFileType (hFile=0x104) returned 0x3 [0053.688] _get_osfhandle (_FileHandle=1) returned 0x104 [0053.688] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x49f1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0053.688] WriteFile (in: hFile=0x104, lpBuffer=0x49f1c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x2af7c8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesWritten=0x2af7c8*=0x3f, lpOverlapped=0x0) returned 1 [0053.688] _vsnwprintf (in: _Buffer=0x49f26340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2af7f8 | out: _Buffer="\r\n") returned 2 [0053.688] _get_osfhandle (_FileHandle=1) returned 0x104 [0053.688] GetFileType (hFile=0x104) returned 0x3 [0053.689] _get_osfhandle (_FileHandle=1) returned 0x104 [0053.689] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0053.689] WriteFile (in: hFile=0x104, lpBuffer=0x49f1c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2af7c8, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesWritten=0x2af7c8*=0x2, lpOverlapped=0x0) returned 1 [0053.689] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0053.689] GetProcAddress (hModule=0x77940000, lpProcName="CopyFileExW") returned 0x779523d0 [0053.690] GetProcAddress (hModule=0x77940000, lpProcName="IsDebuggerPresent") returned 0x77948290 [0053.690] GetProcAddress (hModule=0x77940000, lpProcName="SetConsoleInputExeNameW") returned 0x779517e0 [0053.690] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.690] GetFileType (hFile=0xf8) returned 0x3 [0053.693] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0053.693] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x2af620 | out: TokenHandle=0x2af620*=0x0) returned 0xc000007c [0053.693] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x2af620 | out: TokenHandle=0x2af620*=0x50) returned 0x0 [0053.693] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x2af630, TokenInformationLength=0x4, ReturnLength=0x2af638 | out: TokenInformation=0x2af630, ReturnLength=0x2af638) returned 0x0 [0053.693] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x2af638, TokenInformationLength=0x4, ReturnLength=0x2af630 | out: TokenInformation=0x2af638, ReturnLength=0x2af630) returned 0x0 [0053.693] NtClose (Handle=0x50) returned 0x0 [0053.693] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x2af600, nSize=0x0, Arguments=0x2af608 | out: lpBuffer="韠A") returned 0xf [0053.693] GetProcessHeap () returned 0x400000 [0053.693] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x218) returned 0x401ab0 [0053.693] GetConsoleTitleW (in: lpConsoleTitle=0x2af650, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0053.694] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0053.694] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0053.696] GetProcessHeap () returned 0x400000 [0053.696] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x401ab0 | out: hHeap=0x400000) returned 1 [0053.696] LocalFree (hMem=0x4197e0) returned 0x0 [0053.696] GetProcessHeap () returned 0x400000 [0053.696] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41aa10 | out: hHeap=0x400000) returned 1 [0053.697] _vsnwprintf (in: _Buffer=0x49f26340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2af338 | out: _Buffer="\r\n") returned 2 [0053.697] _get_osfhandle (_FileHandle=1) returned 0x104 [0053.697] GetFileType (hFile=0x104) returned 0x3 [0053.697] _get_osfhandle (_FileHandle=1) returned 0x104 [0053.697] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0053.697] WriteFile (in: hFile=0x104, lpBuffer=0x49f1c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2af308, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesWritten=0x2af308*=0x2, lpOverlapped=0x0) returned 1 [0053.697] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f0f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0053.697] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f1c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0053.697] _vsnwprintf (in: _Buffer=0x49f0eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2af348 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0053.697] _vsnwprintf (in: _Buffer=0x49f0ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2af348 | out: _Buffer=">") returned 1 [0053.697] _get_osfhandle (_FileHandle=1) returned 0x104 [0053.697] GetFileType (hFile=0x104) returned 0x3 [0053.698] _get_osfhandle (_FileHandle=1) returned 0x104 [0053.698] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49f1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0053.698] WriteFile (in: hFile=0x104, lpBuffer=0x49f1c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2af338, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesWritten=0x2af338*=0x26, lpOverlapped=0x0) returned 1 [0053.698] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.698] GetFileType (hFile=0xf8) returned 0x3 [0053.698] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.698] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.698] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.698] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e320, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0053.699] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.699] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.699] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e322, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0053.700] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.700] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.700] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e324, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0053.700] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.700] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.700] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e326, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0053.700] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.700] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.700] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e328, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0053.700] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.700] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.700] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e32a, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0053.700] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.700] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.701] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e32c, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0053.701] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.701] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.701] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0053.701] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.701] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.701] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0053.701] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.701] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.701] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e332, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0053.701] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.701] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.701] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e334, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0053.701] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.701] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.702] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e336, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0053.702] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.702] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.702] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e338, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0053.702] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.702] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.702] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e33a, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0053.702] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.702] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.702] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e33c, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0053.702] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.702] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.702] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e33e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0053.702] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.702] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.703] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.703] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e340, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0053.703] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.703] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.703] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.703] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e342, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0053.703] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.703] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.703] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.703] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e344, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0053.703] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.703] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.704] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.704] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e346, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0053.704] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.704] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.704] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.704] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e348, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0053.704] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.704] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.704] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.704] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e34a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0053.704] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.704] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.704] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.704] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e34c, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0053.704] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.704] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.704] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.704] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0053.704] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.704] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.705] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.705] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0053.705] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.705] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.705] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.705] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0053.705] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.705] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.705] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.705] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0053.705] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.705] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.705] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.705] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0053.705] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.705] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.705] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.705] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0053.706] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.706] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.706] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.706] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0053.706] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.706] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.706] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.706] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0053.706] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.706] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.706] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.706] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0053.706] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.706] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.706] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.706] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0053.706] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.706] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.707] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.707] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0053.707] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.707] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.707] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.707] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0053.707] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.707] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.707] ReadFile (in: hFile=0xf8, lpBuffer=0x49f1c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2af638, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesRead=0x2af638*=0x1, lpOverlapped=0x0) returned 1 [0053.707] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f1c320, cbMultiByte=1, lpWideCharStr=0x49f1e366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0053.708] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.708] GetFileType (hFile=0xf8) returned 0x3 [0053.708] _get_osfhandle (_FileHandle=0) returned 0xf8 [0053.708] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.709] _get_osfhandle (_FileHandle=1) returned 0x104 [0053.709] GetFileType (hFile=0x104) returned 0x3 [0053.709] _get_osfhandle (_FileHandle=1) returned 0x104 [0053.709] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x49f1c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0053.709] WriteFile (in: hFile=0x104, lpBuffer=0x49f1c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x2af618, lpOverlapped=0x0 | out: lpBuffer=0x49f1c320*, lpNumberOfBytesWritten=0x2af618*=0x24, lpOverlapped=0x0) returned 1 [0053.709] GetProcessHeap () returned 0x400000 [0053.709] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x4012) returned 0x41cd20 [0053.709] GetProcessHeap () returned 0x400000 [0053.709] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41cd20 | out: hHeap=0x400000) returned 1 [0053.710] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0053.710] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0053.710] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0053.710] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0053.710] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0053.710] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0053.710] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0053.710] GetProcessHeap () returned 0x400000 [0053.710] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xb0) returned 0x4197e0 [0053.710] GetProcessHeap () returned 0x400000 [0053.710] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x22) returned 0x414610 [0053.711] GetProcessHeap () returned 0x400000 [0053.711] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x48) returned 0x4198a0 [0053.712] GetConsoleOutputCP () returned 0x1b5 [0053.713] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f1bfe0 | out: lpCPInfo=0x49f1bfe0) returned 1 [0053.713] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0053.713] GetConsoleTitleW (in: lpConsoleTitle=0x2af5d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0053.714] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0053.714] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0053.714] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0053.714] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0053.714] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0053.714] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0053.714] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0053.714] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0053.715] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0053.715] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0053.715] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0053.715] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0053.715] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0053.715] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0053.715] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0053.715] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0053.715] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0053.715] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0053.715] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0053.715] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0053.715] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0053.715] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0053.715] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0053.715] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0053.715] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0053.715] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0053.715] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0053.715] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0053.715] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0053.716] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0053.716] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0053.716] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0053.716] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0053.716] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0053.716] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0053.716] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0053.716] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0053.716] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0053.716] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0053.716] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0053.716] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0053.716] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0053.716] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0053.716] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0053.716] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0053.716] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0053.716] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0053.716] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0053.716] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0053.716] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0053.716] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0053.716] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0053.717] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0053.717] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0053.717] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0053.717] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0053.717] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0053.717] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0053.717] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0053.717] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0053.717] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0053.717] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0053.717] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0053.717] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0053.717] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0053.717] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0053.717] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0053.717] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0053.717] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0053.717] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0053.717] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0053.717] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0053.717] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0053.717] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0053.717] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0053.718] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0053.718] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0053.718] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0053.718] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0053.718] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0053.718] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0053.718] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0053.718] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0053.718] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0053.718] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0053.718] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0053.718] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0053.718] GetProcessHeap () returned 0x400000 [0053.719] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x218) returned 0x401ab0 [0053.719] GetProcessHeap () returned 0x400000 [0053.719] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x5a) returned 0x401cd0 [0053.719] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0053.719] GetProcessHeap () returned 0x400000 [0053.719] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x420) returned 0x419a80 [0053.719] SetErrorMode (uMode=0x0) returned 0x0 [0053.720] SetErrorMode (uMode=0x1) returned 0x0 [0053.720] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x419a90, lpFilePart=0x2aee60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2aee60*="Desktop") returned 0x25 [0053.720] SetErrorMode (uMode=0x0) returned 0x1 [0053.720] GetProcessHeap () returned 0x400000 [0053.720] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x419a80, Size=0x6e) returned 0x419a80 [0053.720] GetProcessHeap () returned 0x400000 [0053.720] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x419a80) returned 0x6e [0053.720] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f0f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0053.720] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0053.720] GetProcessHeap () returned 0x400000 [0053.720] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x128) returned 0x415b70 [0053.720] GetProcessHeap () returned 0x400000 [0053.720] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x240) returned 0x419b00 [0053.728] GetProcessHeap () returned 0x400000 [0053.728] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x419b00, Size=0x12a) returned 0x419b00 [0053.728] GetProcessHeap () returned 0x400000 [0053.728] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x419b00) returned 0x12a [0053.728] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f0f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0053.728] GetProcessHeap () returned 0x400000 [0053.728] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xe8) returned 0x419c40 [0053.728] GetProcessHeap () returned 0x400000 [0053.728] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x419c40, Size=0x7e) returned 0x419c40 [0053.728] GetProcessHeap () returned 0x400000 [0053.728] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x419c40) returned 0x7e [0053.985] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0053.986] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x2aebd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2aebd0) returned 0xffffffffffffffff [0053.987] GetLastError () returned 0x2 [0053.987] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x2aebd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2aebd0) returned 0xffffffffffffffff [0053.987] GetLastError () returned 0x2 [0053.987] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0053.987] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x2aebd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2aebd0) returned 0x401d40 [0053.988] GetProcessHeap () returned 0x400000 [0053.988] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x28) returned 0x414640 [0053.988] FindClose (in: hFindFile=0x401d40 | out: hFindFile=0x401d40) returned 1 [0053.988] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x2aebd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2aebd0) returned 0xffffffffffffffff [0053.988] GetLastError () returned 0x2 [0053.989] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x2aebd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2aebd0) returned 0x401d40 [0053.989] GetProcessHeap () returned 0x400000 [0053.989] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x414640, Size=0x8) returned 0x4198f0 [0053.989] FindClose (in: hFindFile=0x401d40 | out: hFindFile=0x401d40) returned 1 [0053.989] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0053.989] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0053.989] GetConsoleTitleW (in: lpConsoleTitle=0x2af120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0053.990] GetProcessHeap () returned 0x400000 [0053.990] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x21c) returned 0x419cd0 [0053.990] GetConsoleTitleW (in: lpConsoleTitle=0x419ce0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0053.990] GetProcessHeap () returned 0x400000 [0053.990] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x419cd0, Size=0xc0) returned 0x419cd0 [0053.991] GetProcessHeap () returned 0x400000 [0053.991] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x419cd0) returned 0xc0 [0053.991] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0053.992] GetProcessHeap () returned 0x400000 [0053.992] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x419cd0 | out: hHeap=0x400000) returned 1 [0053.992] InitializeProcThreadAttributeList (in: lpAttributeList=0x2aeed8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2aee98 | out: lpAttributeList=0x2aeed8, lpSize=0x2aee98) returned 1 [0053.992] UpdateProcThreadAttribute (in: lpAttributeList=0x2aeed8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2aee88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2aeed8, lpPreviousValue=0x0) returned 1 [0053.992] GetStartupInfoW (in: lpStartupInfo=0x2aeff0 | out: lpStartupInfo=0x2aeff0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xf8, hStdOutput=0x104, hStdError=0x104)) [0053.993] GetProcessHeap () returned 0x400000 [0053.993] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x20) returned 0x414640 [0053.993] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0053.993] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0053.993] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0053.993] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0053.993] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0053.993] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0053.993] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0053.993] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0053.993] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0053.993] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0053.994] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0053.994] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0053.994] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0053.994] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0053.994] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0053.994] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0053.994] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0053.994] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0053.994] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0053.994] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0053.994] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0053.994] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0053.994] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0053.994] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0053.994] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0053.994] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0053.994] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0053.994] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0053.994] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0053.995] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0053.995] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0053.995] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0053.995] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0053.995] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0053.995] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0053.995] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0053.995] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0053.995] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0053.995] GetProcessHeap () returned 0x400000 [0053.995] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x414640 | out: hHeap=0x400000) returned 1 [0053.995] GetProcessHeap () returned 0x400000 [0053.995] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x12) returned 0x418900 [0053.995] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2aef10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2aeec0 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x2aeec0*(hProcess=0x54, hThread=0x50, dwProcessId=0x844, dwThreadId=0x854)) returned 1 [0054.027] CloseHandle (hObject=0x50) returned 1 [0054.027] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0054.027] GetProcessHeap () returned 0x400000 [0054.027] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41c230 | out: hHeap=0x400000) returned 1 [0054.028] GetEnvironmentStringsW () returned 0x41aa10* [0054.028] GetProcessHeap () returned 0x400000 [0054.028] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xae8) returned 0x41b500 [0054.028] FreeEnvironmentStringsW (penv=0x41aa10) returned 1 [0054.028] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77a60000 [0054.028] GetProcAddress (hModule=0x77a60000, lpProcName="NtQueryInformationProcess") returned 0x77ab14a0 [0054.029] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ae7c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ae7c8, ReturnLength=0x0) returned 0x0 [0054.029] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdd000, lpBuffer=0x2ae800, nSize=0x380, lpNumberOfBytesRead=0x2ae7c0 | out: lpBuffer=0x2ae800*, lpNumberOfBytesRead=0x2ae7c0*=0x380) returned 1 [0054.029] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) Process: id = "5" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x3445a000" os_pid = "0x844" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0x318" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 26 os_tid = 0x854 Thread: id = 28 os_tid = 0x884 Thread: id = 29 os_tid = 0x8a4 Thread: id = 30 os_tid = 0x8b4 Thread: id = 31 os_tid = 0x8c4 Process: id = "6" image_name = "netsh.exe" filename = "c:\\windows\\system32\\netsh.exe" page_root = "0x35c90000" os_pid = "0x864" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x7dc" cmd_line = "netsh advfirewall set currentprofile state off" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 27 os_tid = 0x874 [0060.892] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24fa30 | out: lpSystemTimeAsFileTime=0x24fa30*(dwLowDateTime=0x134e61a0, dwHighDateTime=0x1d67630)) [0060.892] GetCurrentProcessId () returned 0x864 [0060.892] GetCurrentThreadId () returned 0x874 [0060.892] GetTickCount () returned 0x1147678 [0060.892] QueryPerformanceCounter (in: lpPerformanceCount=0x24fa38 | out: lpPerformanceCount=0x24fa38*=18089507349) returned 1 [0060.894] GetModuleHandleW (lpModuleName=0x0) returned 0x1480000 [0060.894] __set_app_type (_Type=0x1) [0060.894] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x148ad14) returned 0x0 [0060.894] __wgetmainargs (in: _Argc=0x14955c0, _Argv=0x14955d0, _Env=0x14955c8, _DoWildCard=0, _StartInfo=0x14955dc | out: _Argc=0x14955c0, _Argv=0x14955d0, _Env=0x14955c8) returned 0 [0060.895] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0060.896] GetModuleHandleW (lpModuleName=0x0) returned 0x1480000 [0060.896] _vsnwprintf (in: _Buffer=0x1497a40, _BufferCount=0x1fff, _Format="%s>", _ArgList=0x247588 | out: _Buffer="netsh>") returned 6 [0060.896] GetProcessHeap () returned 0x260000 [0060.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2807d0 [0060.896] GetProcessHeap () returned 0x260000 [0060.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2807f0 [0060.896] GetProcessHeap () returned 0x260000 [0060.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280810 [0060.896] GetProcessHeap () returned 0x260000 [0060.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280830 [0060.896] GetProcessHeap () returned 0x260000 [0060.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280850 [0060.896] GetProcessHeap () returned 0x260000 [0060.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280870 [0060.896] GetProcessHeap () returned 0x260000 [0060.896] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2808c0 [0060.897] GetProcessHeap () returned 0x260000 [0060.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2808e0 [0060.897] GetProcessHeap () returned 0x260000 [0060.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280900 [0060.897] GetProcessHeap () returned 0x260000 [0060.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280920 [0060.897] GetProcessHeap () returned 0x260000 [0060.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280940 [0060.897] GetProcessHeap () returned 0x260000 [0060.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280960 [0060.897] GetProcessHeap () returned 0x260000 [0060.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280980 [0060.897] GetProcessHeap () returned 0x260000 [0060.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2809a0 [0060.897] GetProcessHeap () returned 0x260000 [0060.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2809c0 [0060.897] GetProcessHeap () returned 0x260000 [0060.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2809e0 [0060.897] GetProcessHeap () returned 0x260000 [0060.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280a00 [0060.897] GetProcessHeap () returned 0x260000 [0060.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280a20 [0060.897] GetProcessHeap () returned 0x260000 [0060.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280a40 [0060.897] GetProcessHeap () returned 0x260000 [0060.897] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280a60 [0060.898] GetProcessHeap () returned 0x260000 [0060.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280a80 [0060.898] GetProcessHeap () returned 0x260000 [0060.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280aa0 [0060.898] GetProcessHeap () returned 0x260000 [0060.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280ac0 [0060.898] GetProcessHeap () returned 0x260000 [0060.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280ae0 [0060.898] GetProcessHeap () returned 0x260000 [0060.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280b00 [0060.898] GetProcessHeap () returned 0x260000 [0060.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280b20 [0060.898] GetProcessHeap () returned 0x260000 [0060.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280b40 [0060.898] GetProcessHeap () returned 0x260000 [0060.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280b60 [0060.898] GetProcessHeap () returned 0x260000 [0060.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280b80 [0060.898] GetProcessHeap () returned 0x260000 [0060.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280ba0 [0060.898] GetProcessHeap () returned 0x260000 [0060.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280bc0 [0060.898] GetProcessHeap () returned 0x260000 [0060.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280be0 [0060.898] GetProcessHeap () returned 0x260000 [0060.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280c00 [0060.898] GetProcessHeap () returned 0x260000 [0060.898] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280c20 [0060.899] GetProcessHeap () returned 0x260000 [0060.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280c40 [0060.899] GetProcessHeap () returned 0x260000 [0060.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280c60 [0060.899] GetProcessHeap () returned 0x260000 [0060.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280c80 [0060.899] GetProcessHeap () returned 0x260000 [0060.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280ca0 [0060.899] GetProcessHeap () returned 0x260000 [0060.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280cc0 [0060.899] GetProcessHeap () returned 0x260000 [0060.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280ce0 [0060.899] GetProcessHeap () returned 0x260000 [0060.899] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280d00 [0060.899] GetProcessHeap () returned 0x260000 [0060.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280d20 [0060.900] GetProcessHeap () returned 0x260000 [0060.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280d40 [0060.900] GetProcessHeap () returned 0x260000 [0060.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280d60 [0060.900] GetProcessHeap () returned 0x260000 [0060.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280d80 [0060.900] GetProcessHeap () returned 0x260000 [0060.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280da0 [0060.900] GetProcessHeap () returned 0x260000 [0060.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280dc0 [0060.900] GetProcessHeap () returned 0x260000 [0060.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280de0 [0060.900] GetProcessHeap () returned 0x260000 [0060.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280e00 [0060.900] GetProcessHeap () returned 0x260000 [0060.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280e20 [0060.900] GetProcessHeap () returned 0x260000 [0060.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280e40 [0060.900] GetProcessHeap () returned 0x260000 [0060.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280e60 [0060.900] GetProcessHeap () returned 0x260000 [0060.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280e80 [0060.900] GetProcessHeap () returned 0x260000 [0060.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280ea0 [0060.900] GetProcessHeap () returned 0x260000 [0060.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280ec0 [0060.900] GetProcessHeap () returned 0x260000 [0060.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280ee0 [0060.900] GetProcessHeap () returned 0x260000 [0060.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280f00 [0060.900] GetProcessHeap () returned 0x260000 [0060.900] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280f20 [0060.901] GetProcessHeap () returned 0x260000 [0060.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280f40 [0060.901] GetProcessHeap () returned 0x260000 [0060.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280f60 [0060.901] GetProcessHeap () returned 0x260000 [0060.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280f80 [0060.901] GetProcessHeap () returned 0x260000 [0060.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280fa0 [0060.901] GetProcessHeap () returned 0x260000 [0060.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280fc0 [0060.901] GetProcessHeap () returned 0x260000 [0060.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x280fe0 [0060.901] GetProcessHeap () returned 0x260000 [0060.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281000 [0060.901] GetProcessHeap () returned 0x260000 [0060.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281020 [0060.901] GetProcessHeap () returned 0x260000 [0060.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281040 [0060.901] GetProcessHeap () returned 0x260000 [0060.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281060 [0060.901] GetProcessHeap () returned 0x260000 [0060.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2810c0 [0060.901] GetProcessHeap () returned 0x260000 [0060.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2810e0 [0060.901] GetProcessHeap () returned 0x260000 [0060.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281100 [0060.901] GetProcessHeap () returned 0x260000 [0060.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281120 [0060.901] GetProcessHeap () returned 0x260000 [0060.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281140 [0060.901] GetProcessHeap () returned 0x260000 [0060.901] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281160 [0060.901] GetProcessHeap () returned 0x260000 [0060.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281180 [0060.902] GetProcessHeap () returned 0x260000 [0060.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2811a0 [0060.902] GetProcessHeap () returned 0x260000 [0060.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2811c0 [0060.902] GetProcessHeap () returned 0x260000 [0060.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2811e0 [0060.902] GetProcessHeap () returned 0x260000 [0060.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281200 [0060.902] GetProcessHeap () returned 0x260000 [0060.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281220 [0060.902] GetProcessHeap () returned 0x260000 [0060.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281240 [0060.902] GetProcessHeap () returned 0x260000 [0060.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281260 [0060.902] GetProcessHeap () returned 0x260000 [0060.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281280 [0060.902] GetProcessHeap () returned 0x260000 [0060.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2812a0 [0060.902] GetProcessHeap () returned 0x260000 [0060.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2812c0 [0060.902] GetProcessHeap () returned 0x260000 [0060.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2812e0 [0060.902] GetProcessHeap () returned 0x260000 [0060.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281300 [0060.902] GetProcessHeap () returned 0x260000 [0060.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281320 [0060.902] GetProcessHeap () returned 0x260000 [0060.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281340 [0060.902] GetProcessHeap () returned 0x260000 [0060.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281360 [0060.902] GetProcessHeap () returned 0x260000 [0060.902] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281380 [0060.903] GetProcessHeap () returned 0x260000 [0060.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2813a0 [0060.903] GetProcessHeap () returned 0x260000 [0060.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2813c0 [0060.903] GetProcessHeap () returned 0x260000 [0060.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2813e0 [0060.903] GetProcessHeap () returned 0x260000 [0060.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281400 [0060.903] GetProcessHeap () returned 0x260000 [0060.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281420 [0060.903] GetProcessHeap () returned 0x260000 [0060.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281440 [0060.903] GetProcessHeap () returned 0x260000 [0060.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281460 [0060.903] GetProcessHeap () returned 0x260000 [0060.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281480 [0060.903] GetProcessHeap () returned 0x260000 [0060.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2814a0 [0060.903] GetProcessHeap () returned 0x260000 [0060.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2814c0 [0060.903] GetProcessHeap () returned 0x260000 [0060.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2814e0 [0060.903] GetProcessHeap () returned 0x260000 [0060.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281500 [0060.903] GetProcessHeap () returned 0x260000 [0060.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281520 [0060.903] GetProcessHeap () returned 0x260000 [0060.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281540 [0060.903] GetProcessHeap () returned 0x260000 [0060.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281560 [0060.903] GetProcessHeap () returned 0x260000 [0060.903] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281580 [0060.904] GetProcessHeap () returned 0x260000 [0060.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2815a0 [0060.904] GetProcessHeap () returned 0x260000 [0060.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2815c0 [0060.904] GetProcessHeap () returned 0x260000 [0060.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2815e0 [0060.904] GetProcessHeap () returned 0x260000 [0060.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281600 [0060.904] GetProcessHeap () returned 0x260000 [0060.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281620 [0060.904] GetProcessHeap () returned 0x260000 [0060.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281640 [0060.904] GetProcessHeap () returned 0x260000 [0060.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281660 [0060.904] GetProcessHeap () returned 0x260000 [0060.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281680 [0060.904] GetProcessHeap () returned 0x260000 [0060.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2816a0 [0060.904] GetProcessHeap () returned 0x260000 [0060.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2816c0 [0060.904] GetProcessHeap () returned 0x260000 [0060.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2816e0 [0060.904] GetProcessHeap () returned 0x260000 [0060.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281700 [0060.904] GetProcessHeap () returned 0x260000 [0060.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281720 [0060.904] GetProcessHeap () returned 0x260000 [0060.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281740 [0060.904] GetProcessHeap () returned 0x260000 [0060.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281760 [0060.904] GetProcessHeap () returned 0x260000 [0060.904] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281780 [0060.905] GetProcessHeap () returned 0x260000 [0060.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2817a0 [0060.905] GetProcessHeap () returned 0x260000 [0060.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2817c0 [0060.905] GetProcessHeap () returned 0x260000 [0060.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2817e0 [0060.905] GetProcessHeap () returned 0x260000 [0060.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281800 [0060.905] GetProcessHeap () returned 0x260000 [0060.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281820 [0060.905] GetProcessHeap () returned 0x260000 [0060.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281840 [0060.905] GetProcessHeap () returned 0x260000 [0060.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281860 [0060.905] GetProcessHeap () returned 0x260000 [0060.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2818c0 [0060.905] GetProcessHeap () returned 0x260000 [0060.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2818e0 [0060.905] GetProcessHeap () returned 0x260000 [0060.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281900 [0060.905] GetProcessHeap () returned 0x260000 [0060.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281920 [0060.905] GetProcessHeap () returned 0x260000 [0060.905] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281940 [0060.906] GetProcessHeap () returned 0x260000 [0060.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281960 [0060.906] GetProcessHeap () returned 0x260000 [0060.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281980 [0060.906] GetProcessHeap () returned 0x260000 [0060.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2819a0 [0060.906] GetProcessHeap () returned 0x260000 [0060.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2819c0 [0060.906] GetProcessHeap () returned 0x260000 [0060.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2819e0 [0060.906] GetProcessHeap () returned 0x260000 [0060.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281a00 [0060.906] GetProcessHeap () returned 0x260000 [0060.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281a20 [0060.906] GetProcessHeap () returned 0x260000 [0060.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281a40 [0060.906] GetProcessHeap () returned 0x260000 [0060.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281a60 [0060.906] GetProcessHeap () returned 0x260000 [0060.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281a80 [0060.906] GetProcessHeap () returned 0x260000 [0060.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281aa0 [0060.906] GetProcessHeap () returned 0x260000 [0060.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281ac0 [0060.906] GetProcessHeap () returned 0x260000 [0060.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281ae0 [0060.906] GetProcessHeap () returned 0x260000 [0060.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281b00 [0060.906] GetProcessHeap () returned 0x260000 [0060.906] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281b20 [0060.906] GetProcessHeap () returned 0x260000 [0060.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281b40 [0060.907] GetProcessHeap () returned 0x260000 [0060.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281b60 [0060.907] GetProcessHeap () returned 0x260000 [0060.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281b80 [0060.907] GetProcessHeap () returned 0x260000 [0060.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281ba0 [0060.907] GetProcessHeap () returned 0x260000 [0060.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281bc0 [0060.907] GetProcessHeap () returned 0x260000 [0060.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281be0 [0060.907] GetProcessHeap () returned 0x260000 [0060.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281c00 [0060.907] GetProcessHeap () returned 0x260000 [0060.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281c20 [0060.907] GetProcessHeap () returned 0x260000 [0060.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281c40 [0060.907] GetProcessHeap () returned 0x260000 [0060.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281c60 [0060.907] GetProcessHeap () returned 0x260000 [0060.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281c80 [0060.907] GetProcessHeap () returned 0x260000 [0060.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281ca0 [0060.907] GetProcessHeap () returned 0x260000 [0060.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281cc0 [0060.907] GetProcessHeap () returned 0x260000 [0060.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281ce0 [0060.907] GetProcessHeap () returned 0x260000 [0060.907] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281d00 [0060.908] GetProcessHeap () returned 0x260000 [0060.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281d20 [0060.908] GetProcessHeap () returned 0x260000 [0060.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281d40 [0060.908] GetProcessHeap () returned 0x260000 [0060.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281d60 [0060.908] GetProcessHeap () returned 0x260000 [0060.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281d80 [0060.908] GetProcessHeap () returned 0x260000 [0060.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281da0 [0060.908] GetProcessHeap () returned 0x260000 [0060.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281dc0 [0060.908] GetProcessHeap () returned 0x260000 [0060.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281de0 [0060.908] GetProcessHeap () returned 0x260000 [0060.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281e00 [0060.908] GetProcessHeap () returned 0x260000 [0060.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281e20 [0060.908] GetProcessHeap () returned 0x260000 [0060.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281e40 [0060.908] GetProcessHeap () returned 0x260000 [0060.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281e60 [0060.908] GetProcessHeap () returned 0x260000 [0060.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281e80 [0060.908] GetProcessHeap () returned 0x260000 [0060.908] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281ea0 [0060.909] GetProcessHeap () returned 0x260000 [0060.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281ec0 [0060.909] GetProcessHeap () returned 0x260000 [0060.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281ee0 [0060.909] GetProcessHeap () returned 0x260000 [0060.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281f00 [0060.909] GetProcessHeap () returned 0x260000 [0060.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281f20 [0060.909] GetProcessHeap () returned 0x260000 [0060.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281f40 [0060.909] GetProcessHeap () returned 0x260000 [0060.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281f60 [0060.909] GetProcessHeap () returned 0x260000 [0060.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281f80 [0060.909] GetProcessHeap () returned 0x260000 [0060.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281fa0 [0060.909] GetProcessHeap () returned 0x260000 [0060.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281fc0 [0060.909] GetProcessHeap () returned 0x260000 [0060.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x281fe0 [0060.909] GetProcessHeap () returned 0x260000 [0060.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x282000 [0060.909] GetProcessHeap () returned 0x260000 [0060.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x282020 [0060.909] GetProcessHeap () returned 0x260000 [0060.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x282040 [0060.909] GetProcessHeap () returned 0x260000 [0060.909] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x282060 [0060.910] GetProcessHeap () returned 0x260000 [0060.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2820c0 [0060.910] GetProcessHeap () returned 0x260000 [0060.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2820e0 [0060.910] GetProcessHeap () returned 0x260000 [0060.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x282100 [0060.910] GetProcessHeap () returned 0x260000 [0060.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x282120 [0060.910] GetProcessHeap () returned 0x260000 [0060.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x282140 [0060.910] GetProcessHeap () returned 0x260000 [0060.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x282160 [0060.910] GetProcessHeap () returned 0x260000 [0060.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x282180 [0060.910] GetProcessHeap () returned 0x260000 [0060.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2821a0 [0060.910] GetProcessHeap () returned 0x260000 [0060.910] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2821c0 [0060.911] GetProcessHeap () returned 0x260000 [0060.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2821e0 [0060.911] GetProcessHeap () returned 0x260000 [0060.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x282200 [0060.911] GetProcessHeap () returned 0x260000 [0060.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x282220 [0060.911] GetProcessHeap () returned 0x260000 [0060.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x282240 [0060.911] GetProcessHeap () returned 0x260000 [0060.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x282260 [0060.911] GetProcessHeap () returned 0x260000 [0060.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x282280 [0060.911] GetProcessHeap () returned 0x260000 [0060.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2822a0 [0060.911] GetProcessHeap () returned 0x260000 [0060.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2822c0 [0060.911] GetProcessHeap () returned 0x260000 [0060.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x2822e0 [0060.911] GetProcessHeap () returned 0x260000 [0060.911] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x10) returned 0x282300 [0060.911] _wcsicmp (_String1="netsh.exe", _String2="ipxmontr.dll") returned 5 [0060.912] _wcsicmp (_String1="netsh.exe", _String2="ipxpromn.dll") returned 5 [0060.912] GetProcessHeap () returned 0x260000 [0060.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x28) returned 0x27e060 [0060.912] GetProcessHeap () returned 0x260000 [0060.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x2) returned 0x282890 [0060.912] GetProcessHeap () returned 0x260000 [0060.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x14) returned 0x282320 [0060.912] _wcsupr (in: _String="netsh.exe" | out: _String="NETSH.EXE") returned="NETSH.EXE" [0060.912] GetProcessHeap () returned 0x260000 [0060.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x260000) returned 1 [0060.912] GetProcessHeap () returned 0x260000 [0060.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x58) returned 0x2828b0 [0060.912] GetProcessHeap () returned 0x260000 [0060.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x260000) returned 1 [0060.912] GetProcessHeap () returned 0x260000 [0060.912] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb0) returned 0x282910 [0060.912] GetProcessHeap () returned 0x260000 [0060.912] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x2828b0 | out: hHeap=0x260000) returned 1 [0060.913] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\NetSh", ulOptions=0x0, samDesired=0x20019, phkResult=0x247548 | out: phkResult=0x247548*=0x90) returned 0x0 [0060.913] RegQueryInfoKeyW (in: hKey=0x90, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x247570, lpcbMaxValueNameLen=0x247580, lpcbMaxValueLen=0x247578, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x247570*=0x15, lpcbMaxValueNameLen=0x247580, lpcbMaxValueLen=0x247578, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0060.913] GetProcessHeap () returned 0x260000 [0060.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x16) returned 0x282340 [0060.913] GetProcessHeap () returned 0x260000 [0060.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x23) returned 0x27e090 [0060.913] RegEnumValueW (in: hKey=0x90, dwIndex=0x0, lpValueName=0x282340, lpcchValueName=0x247540, lpReserved=0x0, lpType=0x0, lpData=0x27e090, lpcbData=0x247588 | out: lpValueName="4", lpcchValueName=0x247540, lpType=0x0, lpData=0x27e090, lpcbData=0x247588) returned 0x0 [0060.913] _wcsicmp (_String1="rasmontr.dll", _String2="ipxmontr.dll") returned 9 [0060.913] _wcsicmp (_String1="rasmontr.dll", _String2="ipxpromn.dll") returned 9 [0060.913] GetProcessHeap () returned 0x260000 [0060.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x50) returned 0x2828b0 [0060.913] GetProcessHeap () returned 0x260000 [0060.913] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x4) returned 0x2829d0 [0060.914] GetProcessHeap () returned 0x260000 [0060.914] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x1a) returned 0x27e0c0 [0060.914] _wcsupr (in: _String="rasmontr.dll" | out: _String="RASMONTR.DLL") returned="RASMONTR.DLL" [0060.914] GetProcessHeap () returned 0x260000 [0060.914] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27e060 | out: hHeap=0x260000) returned 1 [0060.914] LoadLibraryW (lpLibFileName="RASMONTR.DLL") Process: id = "7" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x32a2a000" os_pid = "0x954" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005b797" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 32 os_tid = 0x5a8 Thread: id = 33 os_tid = 0xa5c Thread: id = 34 os_tid = 0x9e8 Thread: id = 35 os_tid = 0x9dc Thread: id = 36 os_tid = 0x9d8 Thread: id = 37 os_tid = 0x964 Thread: id = 38 os_tid = 0xb24